The interesting part is the ICC-ID. It consists of 19 digits. But the structure of the ID means that this attack was possible because it's not necessary to cycle through 10^19 numbers.

The first two digits will always be 89 (which means that the SIM card was issued for telecommunications purposes), the next two digits will be 01 (which indicates that this is a card from the US), the next four digits will be 4104 (which indicates who made the card). And the final digit is calculated by the Luhn algorithm.

So, of the 19 digits, 9 are fixed. So you've got 10 possible digits. If you started your search from a known iPad SIM ID you could probably get a lot of the IDs without having to search from the start of the 10^10 space.