Use a 0-day remote exploit to get a login, exfiltrate data.
Use a known, unpatched exploit to do same.
Use 0-day/known local exploit with sophisticated spear-phish trojan to do same.
Use leverage over domestic software suppliers to ship a customised exploitable (or directly backdoored) update to target company. Ditto domestic hardware manufacturers.
Black-bag (or diplomatic quid pro quo) tap of external or internal comm links, to get either raw traffic or encrypted. If the latter, apply other complementary techniques to obtain keys.
Infiltrate company with agent who can deploy local exploit via physical access, or who can bug/exploit workstations of users to obtain privileged access to server.
Bully/dupe the German government into raiding & seizing the server as part of an international terror/crime investigation. Acquire disk image from seized machines via direct or complementary techniques.
Purchase/acquire German company via a domestic front company. Demand IT infrastructure be 'harmonised' with acquirer and moved to US.
...and many, many more. The only reason not to do most of these things is because the cost/benefit analysis doesn't make it worthwhile to do universally without any prior suspicion.