The data bits which flow one machine to the other must travel in some way, over wires, optic fiber, radio waves or some other medium. At any point, information can be eavesdropped.
The very low-grade attackers will eavesdrop where it is easiest, i.e. close to either end. This is made easy with many WiFi hotspots; it can also be done with wired Ethernet by plugging into the same switch and "convincing" that switch to degrade to hub mode (i.e. broadcast all packets).
Somewhat higher-grade attackers will hijack one of the routers in the path. Each IP packet from machine A to machine B may have to hop through one or two dozens of routers. A router is nothing less than a computer in its own right (although most of them have a special packaging which makes them look like "network equipment"); as such, they have security holes (e.g. see this one, among many others). When an attacker gains complete access to the internal operating system of the router, he can spy on all the packets which go through the router, and also modify them arbitrarily.
Other attackers will plug in between routers. For radio links, this is as easy as having an antenna (some very directional high-frequency links can make that a bit more difficult). When the link is a simple Ethernet, this can be done even by amateurs. If you consider, for instance, a connection from Boston to Chicago, chances are that it will go through subterranean cables, long parts of which being just buried under a few feet of earth. These are not guarded and can be tapped into quite discreetly.
There are reports that some spy agencies have tried to do just that for at least 15 years, targeting no less than undersea cables, which requires a bit more work than just some night-time hiking and a shovel. Interestingly enough, what the NSA found hardest was to process the high bandwidth data (with the then available computing power).