(Gross oversimplification but..) One seemingly innocuous bug deep in the encryption "library", that no letter could map to itself, plus a bit of social "engineering" in taking advantage of the fact that messages often included the same text (e.g. "heil hitler") often in the same position, with a smattering of German complacency and arrogance assuming that their machine was uncrackable.

Pretty funny that the lessons learned here are still relevant to this day.

The German assumption, throughout the war, was that Enigma could be cracked but it was probably too hard so the Allies would not try. You can see that not all of the German Military was as easily sold on this belief, because some forces stayed with a relatively basic machine while at the end the U-Boats were using a four rotor machine and much stricter rules to reduce attack surface. Ironically they were undone by their need to transmit and receive very succinct messages in order to spend less time on the surface where they were vulnerable.

Germany was in particular unaware that Poland - understandably nervous of an increasingly combative Germany years before the war started - had cracked Enigma when it was a commercial system in the 1930s. This knowledge was transmitted to the British in 1939, and the cryptanalytic team who did it began leaving Warsaw before (inevitably) Germany invaded in September.

There's a small memorial to the Polish code breakers at Bletchley Park, it's not exactly on the main tour, so if you care ask someone when you're there to tell you where. People who were there suggest it made maybe 12 months difference, specifically to Enigma (Bletchley Park did other less famous cryptographic work) which is a pretty significant difference.

Enigma is interesting because it's so famous and yet it's completely the wrong design, and this is exactly the era when people stop doing that. The Colossus computer, also at Bletchley park, is to break the Lorenz cipher not Enigma, because Lorenz is a much more "normal" design to us today. It's a Vernam stream cipher, it encrypts bit streams and it merely so happens that those bit streams are Morse code. You could perhaps say Lorenz is a (distant) ancestor of, say, ChaCha20.

In contrast Enigma looks like cryptography from previous centuries, it encrypts symbols, one symbol in -> one encrypted symbol out. No letter on your Engima machine's keyboard representing the symbol you wanted? Say it in words or don't encrypt it. This is in some ways more practical (Enigma was actually used with radio traffic, but in principle you could send letters, or encrypt your diary, or whatever) but in cryptographic terms it's a complete nightmare.

Even after it was "broken", it took a lot of work to decrypt - sometimes allies were months the German messages.