Was it Hetzner, or was it an attacker hosting on Hetzner/Linode?

It was the German equivalent of the NSA, with the German equivalent of a National Security Letter, sent to Hetzner to force them to intercept this customer's traffic. The same thing happens in the USA.