I interpret "hacked" as "compromised". Suspicious activity and vulnerability reports don't meet that criteria. In that case, only 2015 and 2022 would qualify.

The activity in 2011 was never confirmed to be a breach. It was a overcautious response on LastPass's part after seeing an outlier in the logs. The investigating party gave a report saying they couldn't find anything, and the CEO later gave a statement saying they overreacted to an outliter out of an abundance of caution.