It says “for adjective adjective cyber theft”, which implies the undisclosed is just modifiyig the object they were fined for. GP is not alone in their confusion, top comment right now is talking about how it’s a slap on the wrist _for the breach_ (and not for the lack of disclosure).

A better title would be “SEC Penalizes Yahoo for Failure to disclose Massive security breach”

Then failure to disclose is the object

Not it isn’t. “Undisclosed” is an adjective. The title says that the SEC penalized Yahoo for a “cyber theft” that was “massive” and “undisclosed.”

“SEC Penalizes Yahoo $35M for Non-Disclosure of Massive Cyber Theft” would be better.