The internet works by organisations "announcing" the IP ranges they're allocated to other networks (ISPs, other large companies etc.) Networks that receive an announcement will route traffic for those IP ranges to the network that announced them.

The protocol by which this is done is called BGP. The original version of this was created in 1989 and back then everyone involved trusted each other. So there is no security built in to prevent a rogue company announcing addresses they don't own, and therefore pulling in traffic people send to those addresses.

Organisations can and do put filters in place to try and stop this, but because it's not a core baked in feature of BGP not everyone does, and issues can happen.

Sometimes these things are just mistakes engineers make, re-announcing routes they've learnt elsewhere. Sometimes they are deliberate hi-jacks.

Basically, a router somewhere in Russia claimed to be the owner of some ip addresses belonging to Google, Facebook, etc. Other neighbouring routers began forwarding packets from actual users to this router. The packets contain the HTTPS requests people were making to these sites.

Internet traffic goes through whatever path will get it to it's destination fastest. Big Routers advertise to each other how long it will take to get somewhere through them. There have been times when either due to bugs, or due to a desire to slurp traffic, some machines have falsely advertised shorter routes causing traffic to pas through routes traffic wouldn't normally pass through. This time it was somewhere in Russia. This can be mitigated like most malicious acts / network errors if you write clever enough rules, but is hard because you have to identify the bad actors, or paths that lead to them.