They do that all the time. The first ransom is to get the decryption keys to the target's data, the second ransom is to prevent them from publishing the decrypted data.
A lot of folks now have ransomware protected backups for critical data so they aren't paying for decryption keys.
This has escalated to hack and release, the attackers are now exfiltrating data and threatening to make it public in addition to encrypting it on the host system.
Because they will publish the bad stuff, the stuff you really don't want public, but likely withhold the boring stuff, the stuff the business really needs to function. And whatever they release might not be in the format that it was taken.