The article seems to suggest that it was inter-site links that were compromised and not actual Google data centers. Those compromises could happen at telco data centers or even in the field (e.g., by splicing monitoring equipment into a cable).