The Brief

The online education platform Canvas went offline after a data breach on Thursday, temporarily leaving students and faculty at thousands of U.S. colleges — and K-12 schools — without access to course materials and communications during finals period.

"I'm sure somewhere in the country when the outage happened, there probably were people actually taking final exams on the platform when it crashed," says Damon Linker, a senior lecturer in political science at the University of Pennsylvania.

Thirty million users — including at half of the higher education institutions in North America — rely on Canvas to manage courses, submit assignments, view grades and facilitate communication, according to its parent company, Instructure.

But when Linker and many other users tried to do so on Thursday afternoon, they met a black screen and a warning message.

"ShinyHunters has breached Instructure [again]," it read. "Instead of contacting us to resolve it they ignored us and did some 'security patches.'"

ShinyHunters is the same entity that took credit for a massive Ticketmaster data breach in 2024. Like many such groups, it's a cluster of young people working remotely together, "kind of like a ransomware gang," says Rachel Tobac, the CEO of SocialProof Security, which trains people and companies to defend themselves against hackers.

ShinyHunters wrote on a threat intelligence website earlier this week that the initial breach on Saturday involved data — including private messages — from 275 million students, teachers and staff at nearly 9,000 schools worldwide. The group said Thursday that affected schools can prevent the release of their data by consulting with cyber advisory firms and negotiating settlements through the encrypted chat platform Tox.

"You have till the end of the day by 12 May 2026 before everything is leaked," the hackers wrote.

Instructure has confirmed a series of cybersecurity breaches this week and provided status updates on its website. It said the breach only appeared to involve identifying information like names, email addresses, student ID numbers and user messages — no passwords, birth dates, government identifiers or financial information.

Instructure confirmed on an FAQ page that it started an investigation after it first detected unauthorized activity in Canvas on April 29, and took Canvas offline on Thursday after that same unauthorized actor "made changes that appeared when some students and teachers were logged in." They said the actor exploited an issue with its Free-for-Teacher accounts, which it has temporarily shut down.

"This gives us the confidence to restore access to Canvas, which is now fully back online and available for use," it said in a statement to NPR. "We regret the inconvenience and concern this may have caused."

It's not clear whether Instructure paid a ransom or what the return of Canvas access could mean for the hackers' May 12 deadline.

Tobac says Canvas could be back online because of a successful negotiation, or because the hackers "didn't get super far in their attack." Either way, she says users should stay vigilant, especially for phishing messages — whether it's someone posing as Canvas prompting a password change, or pretending to be a professor sending course materials.

"I would operate under the assumption that there's going to be some knock-on effects here," she says.

Not everyone got back online immediately 

Just before midnight on Thursday, Instructure posted online that "Canvas is now available for most users," though two separate services, Canvas Beta and Canvas Test, remained in maintenance mode.

Students and faculty at at least some schools were still unable to access Canvas on Friday — either because service had not yet been restored or because administrators warned them to stay away.

Penn State University, for example, said Friday morning that while the school's Canvas access had been partially restored, it was "not yet ready for use."

"Technical teams at Penn State are actively working to prepare the system for our community," it added. "As access is restored, Canvas integrations and related services will be brought back online in phases."

Several schools have taken similar approaches, either temporarily disabling Canvas access or outright asking users to steer clear. The University of California said across its schools, "Canvas access will not be restored until we are confident the system is secure."

And it's not just higher education: The Montgomery County Public School system in Maryland alerted families on Friday morning that even as service returned, it is "continuing to test and review systems before restoring access."

Tobac says this could mean that schools think the attackers might still be within their systems, potentially stealing information like passwords and messages.

"The attackers probably got some sensitive information and … [schools] don't want this information out online," she says.

Many schools are urging users to be on high alert for any unsolicited emails or messages that appear to come from Canvas, especially those requesting login credentials, as Georgetown University warned. The University of Amsterdam — which says it's one of 44 Dutch educational institutions affected — also recommends people change their passwords on any other sites where they use the same one.

Tobac also recommends using a password manager — to generate long, random passwords for each login — and turning on multi-factor authentication for all online accounts, not just Canvas. She says any student or professor who gets a suspicious call, text or email should "use another method of communication to verify what is authentic."

"Even if there was no breach yesterday, I would say these are the things that I recommend you do," she adds, urging people to "be politely paranoid."

The breach disrupts finals, highlights vulnerabilities

Several schools affected by the breach have already postponed or outright scrapped some final exams, with others warning students and professors that they might need to do so.

The University of Illinois is postponing all final exams and assignments scheduled through Sunday. Penn State canceled certain exams scheduled for Thursday night and Friday, saying it was working with faculty to "determine next steps for final grading" and urging students to check their emails (not Canvas) regularly in the meantime. And Baylor University delayed Friday exams and asked all faculty to send students "whatever study materials they have on their local computers to students as soon as possible."

The breach has underscored how much of academia relies on a single, centralized platform.

Linker, of UPenn, told NPR that he received an influx of panicked messages from students on Thursday afternoon when they suddenly couldn't access PowerPoints, readings and previous exams as they tried to study for Monday's final.

"The problem with using a platform like Canvas is that most [students] are not going to have the readings available printed out or on their laptops," he explains. "It all lives on the online platform, and if that platform goes down, they have no way to access them."

He told students on Thursday that he would upload the course materials to another platform (like Dropbox or Google Docs) if Canvas access wasn't restored by Friday morning. Fortunately, he says, it came back online shortly before 9 a.m. ET.

But Linker says he has concerns about relying fully on Canvas in the future.

"Given what this has exposed, the vulnerability involved and also the concern with the data breaches, I'm starting to rethink whether this is really a wise way to proceed," he says.

One example of that is grading. Linker says Canvas makes it so easy to calculate and weigh students' scores — on individual assessments and overall — that it's come to function as a digital grade book. Going forward, he says he may start keeping an analog record of students' grades just in case.

While Canvas does have competitors like Blackboard, Linker says he doesn't think any would be less vulnerable to a future breach. And Tobac agrees.

"The problem is not that this one website had this cyber event, right? Because nothing in this world is unhackable," she says. "The thing that we have to think about is disaster recovery: How do we continue doing business when there is a cyber event, and how do we do our very best to keep the bad actors out?"

Tobac says this week has shown that many institutions did not have a clear plan for how students and professors can be in touch and access course materials without Canvas. She said those plans should vary based on schools' different circumstances and schedules — which might explain why some are proceeding with finals as usual while others are scrapping exams altogether. But she'd like them to approach the immediate aftermath with one common goal.

"We have to treat people with dignity and respect," Tobac says. "And I hope that that is something that the institutions do, within their timelines and constraints."
Copyright 2026 NPR

Joseph Babbitt of Springfield, Mo. has a pretty good deal when it comes to health insurance. He works as a senior financial controller for West Plains Veterinary Supply, which employs about 50 people and distributes pet food, toys and vet supplies across the region.

Like about 157 million Americans, Babbitt gets insurance through his job. Unlike most Americans, his job has exceptionally generous benefits. "Our owners are very nice — they give all of our employees healthcare and they pay for it," he says. The company offers several different plan options and covers most or all of the monthly premium cost.

So why, even with free premiums, does it still feel like health costs are way too expensive? "Everybody talks about healthcare and how much it's costing them," says Babbitt. He explains that even without monthly premiums, a high deductible can be brutal — that's the amount the patient has to spend out-of-pocket before the insurance company starts paying for doctors visits and procedures, etc.

Now age 60, he remembers a time when it wasn't so bad. "Back in the '90s, our deductibles were $250 [or] $500 — now they're $5,000," he says. "That seems like a lot."

"We are the only country on our planet that forces people into bankruptcy because they get sick," he adds.

The cost of a new car, every year

Healthcare costs are rising fast in the U.S., and even workers with solid healthcare benefits through work are feeling it, according to an annual survey of nearly 2,000 employers about their health benefits. The report was published Thursday by KFF, a nonpartisan health research organization.

"The average health insurance premium for a family of four is now $28,000, which is just a ton of money," says Matthew Rae, associate director for the Health Care Marketplace Program at KFF. "It's basically the cost of a new car every year just to keep a family of four insured." Of that total for family premiums, workers pay about $7,000 per year on average and employers pay the rest.

A glimmer of positivity is that the costs for plans isn't growing as fast as it has in years past, he explains. "We're seeing a 5% increase in family health insurance premiums, which continues a period of modest growth," he says. That increase is roughly on par with worker wages and inflation.

However, "a 5% increase on a big number is still a lot of money," Rae points out. Plus, the growth for the portion of the premium costs that workers pay was 9%. "If this is the beginning of a shift of costs onto workers, that would be a big deal in terms of affordability," he says.

"We are asking people to chip in a lot of money," Rae adds. "Many people are committing a big chunk of their income to health insurance."

The uninsured rate is rising 

Another report published Thursday demonstrates the way these high costs affect people's health. The survey, conducted every two years by the Commonwealth Fund, a nonprofit foundation that supports independent research, is entitled "The State of Health Insurance Coverage in 2026."

Even for workers fortunate enough to have health benefits, "about 43% of them said that they didn't get healthcare because of cost over the past year, and about 31% reported that they had medical debt," says Sara Collins, lead author of the report.

Another key finding was that the overall uninsured rate rose in the last two years. Collins says that's significant but not surprising, because of federal policy decisions like letting extra federal subsidies for people enrolled in Affordable Care Act plans expire, and people losing Medicaid after the pandemic emergency ended.

Federal data shows millions of people have lost health coverage already from either Medicaid or the ACA marketplaces. When work requirements take effect next year, millions more people are projected to lose Medicaid.

"There is a, I think, a strong feeling across the country that something probably does need to be done to the situation that people are facing in their health and health insurance — both on the cost side and then also on these coverage losses," Collins says.

"We asked people whether the federal government has a responsibility to ensure that all Americans have coverage and nearly three quarters said yes to that — that included about 45% of Republicans, 93% of Democrats and 76% of independents."

Copyright 2026 NPR

Mike Obedoza’s Lumpia Smash Burger begins with the flavorful marinade his mother uses for making lumpia, a crispy Filipino spring roll. He folds it into a beef patty, then tops it with a fried lumpia wrapper, creamy avocado slices and fresh jalapeño.

For Obedoza, who grew up in Carson as the son of Filipino immigrants and now resides in Tustin, the burger is more than a winning recipe. “This is me on a plate,” he said.

Fresh off back-to-back Best Burger wins at the Old Towne Burger Fest in Orange County, Obedoza has landed a residency at Grand Central Market in downtown L.A. as Banger Lumpia.

He attributes his current success to the broader Filipino American food moment happening in Southern California, from Lord Maynard Llera of Kuya Lord winning Best Chef: California at the 2024 James Beard Awards to other Filipino food business upstarts' local success, including San & Wolves in Long Beach.

Mike Obedoza works the griddle, making Filipino-American Smashburger dreams come true.

(

Courtesy Banger Lumpia

)

“I’m one component of a whole movement that’s happening right now,” he said.

His residency closes this weekend as part of Filipino American History Month, capping off a whirlwind couple of months Obedoza doesn’t take for granted, especially the love he's received from his own community.

“We get a lot of Filipinos that pass by us glowing. … They’re stoked that there’s some Filipino representation,” he said.

Building the burger

Before Banger Lumpia, Obedoza’s pop-up was called Banger, and he folded Filipino flavors like sisig into tacos. Once customers learned the food was Filipino, they kept asking for the classics. “Where’s the lumpia? Where’s the pancit?” he recalled.

Since lumpia filling is marinated ground meat, a burger felt like the natural next step. Obedoza took the marinade from his mother’s lumpia recipe (onions, carrots, soy sauce and fish sauce) and worked it into an all-beef smash patty.

Back-to-back wins: Obedoza’s Lumpia Smashburger took home Best Burger at the Old Towne Burger Fest in 2025 and 2026.

(

Courtesy Banger Lumpia

)

Jalapeño and avocado add a California finish. “It’s like this perfect blend of being Filipino and Californian,” Obedoza said.

The idea has deep roots in Southern California. Obedoza points to Kogi, the Korean taco truck Roy Choi launched in L.A., which Choi said drew on a kind of local terroir. “I don’t see mustard plants and sheep grazing,” Choi said in a 2014 CNN segment with Anthony Bourdain. “I see barbed wire and telephone poles.”

“It’s a representation of the soil we were raised in," Obedoza said. “I think the Lumpia Smash burger is just my version of that.”

From skater to chef

Growing up in Carson, Obedoza found his creative outlet in rollerblading, competing and filming for sponsors. His favorite skater was Jon Julio, a Filipino American legend of the sport. “That was big for someone, a Filipino growing up in America,” Obedoza said. “I can’t think of anyone else at that time that was a representation of that.”

Obedoza studied hotel and restaurant management at Cal Poly Pomona, where a broken ankle from a skate competition pushed him to get serious about cooking. After graduating in 2007, he completed an accelerated program at the Culinary Institute of America in Greystone in St. Helena. Then, in 2008, he took a trip to the Philippines with his dad that reshaped how he saw himself.

From the skate park to the griddle, Banger Lumpia’s Mike Obedoza puts his whole self on the plate.

(

Courtesy Banger Lumpia

)

“In the States, I’m Filipino. But when I go there, I’m American,” he said.

Back home, he cooked at hotels including Hyatt and Terranea Resort before moving into marketing and e-commerce. In 2022, he started serving tacos at skate parks under the name Banger. He went full-time in 2023 and has been popping up in L.A. and O.C. ever since.

That same cultural tension carries over into his food. While his Lumpia Smash burger has won praise, Obedoza says some Filipino customers pick apart the more traditional dishes on his menu: the lumpia isn’t made right, they say, the dipping sauce and adobo need more sugar, the adobo isn’t dark enough or has no bone.

“I guess I win on the burgers, but I’ll never win on being Filipino enough,” he said.

He said his cooking reflects his parents’ style and their home region of Central Luzon, north of Manila on the Philippines’ largest island. If it doesn’t match what someone grew up with, he says to get it from their own family.

Despite those differences, Obedoza says that lumpia is “the gateway drug to Filipino food” and hopes that his customers will feel emboldened to try the rest of the menu. He sees the Grand Central Market residency as a test run for an eventual brick-and-mortar. Whatever comes next, he credits one choice: “I went all in on being unique.”

Julia Feinberg feels like she’s living in a sinister version of Groundhog Day. For the second year in a row, California lawmakers have made it tougher for seniors and people with disabilities to qualify for state-funded health benefits.

Feinberg, 37, who has a degenerative neuromuscular disorder, said without Medi-Cal she would be confined to a nursing home rather than living and working as a therapist in Oakland.

“We keep having to have the same fight over and over and over again,” Feinberg said. She requires a power wheelchair and about 19 hours of caregiving each day, which Medi-Cal covers.

California is cutting Medi-Cal after a decade of expansion, part of sweeping federal and state cuts that experts estimate will kick more than 2.2 million Californians off coverage in the next four years, doubling the state’s uninsured rate.

The latest cut came in June, when state leaders approved a budget that will lower the asset limit for low-income seniors and people with disabilities to $21,000 to qualify for Medi-Cal, starting in July 2027. Feinberg, who has built up emergency savings, will have to spend about $10,000 to get under the cap.

In 2024, the state eliminated longstanding Medi-Cal asset limits, but since then lawmakers have chipped away at that policy. At the beginning of this year, state leaders reinstated an asset limit of $130,000, and the June budget lowered it further.

A primary residence and one vehicle are exempt from the new limit, but people 65 and older as well as those with disabilities cannot own a second home or car, and they can’t have more than $21,000 in savings accounts, certain retirement accounts, life insurance policies or even burial plots. They must still meet Medi-Cal income eligibility limits of about $1,800 a month for a single person.

Advocates say the rules unfairly target older people and those with disabilities.

“It’s really expensive to be disabled,” said Elizabette Guéçamburu, 44, who like Feinberg has spinal muscular atrophy and requires a power wheelchair as well as daily caregiving.

Guéçamburu said she’s saving up for a used wheelchair-accessible van, which costs about $75,000. Home modifications such as adding ramps and making bathrooms accessible also cost tens of thousands of dollars, none of which are covered by Medi-Cal. Guéçamburu said those expenses would be impossible to afford if she couldn’t save.

Guéçamburu lives on her family’s farm in Patterson where they grow walnuts, almonds and alfalfa. She works part time as the farm’s bookkeeper. In 2024, doctors diagnosed Guéçamburu’s father with prostate cancer, and he could no longer act as her caregiver. The same year, California eliminated asset limits for people with disabilities and seniors — Guéçamburu cried, able to qualify for Medi-Cal for the first time.

“The timing was a godsend,” she said.

Now, her aging father is unable to take care of her should she lose Medi-Cal, and Guéçamburu is struggling to figure out what to do with money left to her by her grandmother. She’ll likely have to put it into a special needs trust controlled by a family member and give up financial independence. She also had her family strike her from inheriting any portion of their 100-year-old farm. Private home care costs thousands of dollars a month, making it hard for lower- and middle-income people to pay for it out-of-pocket.

“I have to surrender our legacy just to have medical security and have the ability to live my life,” Guéçamburu said.

Asset limit flip-flop

Gov. Gavin Newsom eliminated Medi-Cal asset requirements in 2024 after a yearslong campaign by senior and disability rights advocates. In a statement before the elimination, Newsom said he was proud of the “bold investments” his administration was making to “protect life savings and homes.”

But two years later, faced with a $12 billion budget shortfall, Newsom proposed reinstating the former $2,000 limit, arguing that more than twice as many people enrolled as previously estimated. The Legislature opposed that proposal and compromised at the current higher limit of $130,000, lowering it again to $21,000 starting next July.

Lindsay Imai Hong, California director for Hand In Hand, an advocacy group supporting families that need caregiving, said organizers are looking to the next governor for change.

“We would love to see the asset test permanently taken off of the chopping block,” Imai Hong said.

Republican gubernatorial candidate Steve Hilton said in a statement to CalMatters that he opposes asset limits. He criticized the state for extending other Medi-Cal benefits beyond what it could afford, including coverage for immigrants without legal status.

“Seniors and people with disabilities shouldn’t lose their coverage because they’ve managed to save some money. They’ve done the responsible thing. Why punish them for it?” he said.

Democratic gubernatorial candidate and front-runner Xavier Becerra did not answer specific questions about the asset limit policy, but a campaign spokesperson blamed the Trump administration’s federal cuts for “squeezing” California’s Medi-Cal program.

Becerra will be “focused on protecting access to care and demand savings that are real, measurable and sustainable,” spokesperson Johnathan Underland said. On the campaign trail, Becerra has called himself California’s next “healthcare governor” and has previously floated raising taxes to reverse Medi-Cal cuts, but has not released detailed health policy plans.

Camille Nguyen, an attorney with the Legal Aid Society of San Mateo County, said most people who struggle to stay under the limit have little financial security.

“They have all of their life savings in cash savings instead of a house. That's their retirement. That is the amount they are expecting to live off of for the rest of their life,” Nguyen said.

State data shows about 600 people lost Medi-Cal when California reinstated the $130,000 limit. Advocates expect many more to lose Medi-Cal at the lower limit, but the state never released budget estimates before lawmakers approved the $21,000 limit. If the state reinstated the much lower $2,000 limit, the Department of Finance estimated 62,000 seniors and people with disabilities would lose Medi-Cal over two years.

Limit fuels anxiety, anger among people with disabilities

Feinberg said the prospect of losing Medi-Cal is especially scary because she would also lose access to a special disability program that pays for extra caregiving hours and has a multiyear waitlist. Caregivers help Feinberg get in and out of bed, dress and prepare her meals.

Before the limit was erased in 2024, Feinberg said she checked her bank account every day to make sure the balance was low. At the time, Feinberg was a graduate student and did not earn very much money. Now, as a licensed therapist Feinberg has been able to squirrel away some money.

“I don’t want to spend down that money. I want to save that for retirement, maybe buying a house in the future,” Feinberg said. “The prospect of not being able to have a nest egg is very unsettling.”

Guéçamburu said she’s angry and frustrated that the state views services for people with disabilities as expendable.

“It’s exhausting to have to justify your existence every legislative cycle,” she said.

Supported by the California Health Care Foundation (CHCF), which works to ensure that people have access to the care they need, when they need it, at a price they can afford. Visit www.chcf.org to learn more.

This article was originally published on CalMatters and was republished under the Creative Commons Attribution-NonCommercial-NoDerivatives license.