Two key ideas minimized disruption. The core application functions that hash card numbers were modified to take a new parameter - which hash algorithm to use. (We had some older clients using a hard coded SHA1, and some newer clients using a hard coded 256 - on a “Version 2” core code base).
With each client’s new parameter set to the existing value (SHA1 or SHA256), the code change was launched (2 lines of code: 300+ test cases) but ... no data was changed. We did this so that we could “flip the switch” (to 512) one client at a time. It took a couple of hours of down time (2 am - 4am) to validate the code changes, but - at least - no data updates were needed now.
The actual conversion of each client (one at a time) took less than a minute of down time, accomplished by precomputing a completely new table, and doing a table rename along with the publish of the parameter change.
