Not familiar with apple ID but I've worked lots with CAS/SAML2/OAUTH sounds like userIdentifier was a pairwise ID and apple touched something with the integrating service causing the pair to change. the sub claim in OAUTH would act similarly.