They state using hardware DDoS protection but it seems not to be sufficient: https://www.hetzner.com/unternehmen/ddos-schutz