The organization should apologize to and1 reinstate the waitress and2 ask her to apologize for her breach of customer privacy and3 post both on social media.
Please note that I've removed the parenthetical from the model.
There are three instances of the conjunction "and". They are not all equal.
The first conjunction pairs "apologize to" with "reinstate". This joined pair takes "the waitress" as its object. So far, we have one potential apology, and it's from the organization to the waitress. Also, the waitress potentially gets her job back.
The second and third conjunctions do seem equal. They combine three different things that are all governed by the verb "should": the phrasing that starts with "apologize to and reinstate", the phrasing that starts with "ask", and the phrasing that starts with "post".
In effect, and1 is smaller. It's found inside one of the things that and2 and and3 join together.
A) apologize to the waitress (and1 reinstate her)
B) ask her to apologize (for her breach of customer privacy)
C) post both on social media
At this point, we now have two potential apologies: one from the organization to the waitress, and another from the waitress to -- well, it doesn't say. Probably just to the specific customer or customers affected by the breach, since that's what the apology is for.
I'm making a couple of educated guesses. I've guessed that the wording in parentheses in your post is your own editorial commentary, and that it doesn't appear in the original case study. I've also guessed that you're mistaken.
Given the layout presented above, this "both" on line C) should relate to both lines A) and B).
The organization should apologize to the waitress. The organization should ask the waitress to apologize to any affected customers. The organization should post both apologies to social media.
The first potential apology is an apology from the organization to the waitress, not from the organization to the public in general. However, once posted, the general public can view it. It is not to everyone, but it is (at least in part) for everyone. The same can be said of the apology from the waitress to whoever was affected by her breach of customer privacy.
If you did not add the wording "(apology for the mistake and she being reinstated again)" on your own, then my analysis is probably flawed and you should ignore it.