"Astonishingly, the private keys were 4, 56, 66, 115, 155, 156, 230, 237."
tl;dr basically they used Password123
Ars TechnicaThe Internet goes on high alert after discovery of 8 compromised TLS certsIntermediate certs allow anyone to mint web credentials for any Internet server.