The ransomware group behind the MIP Holdings breach now appears to be extorting insurers directly.