It happens. Engineer goes to upgrade the cert and copies it to a file share they didn't realize wasn't locked down. There's no evidence anyone malicious got the file but it's pretty standard protocol to just assume it's tainted and get a new cert.

I wish they would say how it was disclosed. Your scenario is bad, but less bad than actually sending it out to the Internet, or some malware on a dev's machine grabbing it.

I give equal likelihood to it being malware related, to somebody moving just disabling a settings on some server that can potentially connect to the server hosting the key.

I don't think it's somebody just posting it online, or moving it.

My money would be on somebody commiting something to an externally facing and not security certified system. You see it quite a lot things that should be in gitignore for example.

Eh, shit happens. Everything can't be perfect all the time. Especially in security.

Pretty dangerous line of thinking when it comes to private keys for a wildcard cert on such a high traffic (and probably high value) target...

I didn't say "Don't try to get it right" I said "eh, shit happens."

This might seem unusual, but having thought about this a lot, I think the issue was with naming PKI concepts. Calling the public part of the keypair a 'public key' has conditioned people that 'uploading a key' is a normal thing to do. Once 'uploading keys' is normal, it's not a huge step for a user who doesn't know PKI well to go from uploading their public key to uploading their private key.