There's now an article here http://www.nu.nl/internet/2607758/diginotar-negeerde-misbruik-en-was-slecht-beveiligd.html http://www.nu.nl/internet/2607758/diginot

There's now an article here http://www.nu.nl/internet/2607758/diginotar-negeerde-misbruik-en-was-slecht-beveiligd.html http://www.nu.nl/internet/2607758/diginotar-negeerde-misbrui... which details the FoxIT (a Dutch security firm) report on the situation. Looks like sysadmin passwords were brute forced to obtain elevated access, and that keys were stored in a seperate database (going against the written procedures and rules)