My recollection says twice. However, the number of times a company tells the media it has had a breach does not correspond to the number of times data has been exfiltrated.

Notifying customers of a breach is a much more ethical approach than sitting on the information. In some countries it is even mandetory to report breaches to affected users, which I personally think is better than not doing it.