The Brief

The online education platform Canvas went offline after a data breach on Thursday, temporarily leaving students and faculty at thousands of U.S. colleges — and K-12 schools — without access to course materials and communications during finals period.

"I'm sure somewhere in the country when the outage happened, there probably were people actually taking final exams on the platform when it crashed," says Damon Linker, a senior lecturer in political science at the University of Pennsylvania.

Thirty million users — including at half of the higher education institutions in North America — rely on Canvas to manage courses, submit assignments, view grades and facilitate communication, according to its parent company, Instructure.

But when Linker and many other users tried to do so on Thursday afternoon, they met a black screen and a warning message.

"ShinyHunters has breached Instructure [again]," it read. "Instead of contacting us to resolve it they ignored us and did some 'security patches.'"

ShinyHunters is the same entity that took credit for a massive Ticketmaster data breach in 2024. Like many such groups, it's a cluster of young people working remotely together, "kind of like a ransomware gang," says Rachel Tobac, the CEO of SocialProof Security, which trains people and companies to defend themselves against hackers.

ShinyHunters wrote on a threat intelligence website earlier this week that the initial breach on Saturday involved data — including private messages — from 275 million students, teachers and staff at nearly 9,000 schools worldwide. The group said Thursday that affected schools can prevent the release of their data by consulting with cyber advisory firms and negotiating settlements through the encrypted chat platform Tox.

"You have till the end of the day by 12 May 2026 before everything is leaked," the hackers wrote.

Instructure has confirmed a series of cybersecurity breaches this week and provided status updates on its website. It said the breach only appeared to involve identifying information like names, email addresses, student ID numbers and user messages — no passwords, birth dates, government identifiers or financial information.

Instructure confirmed on an FAQ page that it started an investigation after it first detected unauthorized activity in Canvas on April 29, and took Canvas offline on Thursday after that same unauthorized actor "made changes that appeared when some students and teachers were logged in." They said the actor exploited an issue with its Free-for-Teacher accounts, which it has temporarily shut down.

"This gives us the confidence to restore access to Canvas, which is now fully back online and available for use," it said in a statement to NPR. "We regret the inconvenience and concern this may have caused."

It's not clear whether Instructure paid a ransom or what the return of Canvas access could mean for the hackers' May 12 deadline.

Tobac says Canvas could be back online because of a successful negotiation, or because the hackers "didn't get super far in their attack." Either way, she says users should stay vigilant, especially for phishing messages — whether it's someone posing as Canvas prompting a password change, or pretending to be a professor sending course materials.

"I would operate under the assumption that there's going to be some knock-on effects here," she says.

Not everyone got back online immediately 

Just before midnight on Thursday, Instructure posted online that "Canvas is now available for most users," though two separate services, Canvas Beta and Canvas Test, remained in maintenance mode.

Students and faculty at at least some schools were still unable to access Canvas on Friday — either because service had not yet been restored or because administrators warned them to stay away.

Penn State University, for example, said Friday morning that while the school's Canvas access had been partially restored, it was "not yet ready for use."

"Technical teams at Penn State are actively working to prepare the system for our community," it added. "As access is restored, Canvas integrations and related services will be brought back online in phases."

Several schools have taken similar approaches, either temporarily disabling Canvas access or outright asking users to steer clear. The University of California said across its schools, "Canvas access will not be restored until we are confident the system is secure."

And it's not just higher education: The Montgomery County Public School system in Maryland alerted families on Friday morning that even as service returned, it is "continuing to test and review systems before restoring access."

Tobac says this could mean that schools think the attackers might still be within their systems, potentially stealing information like passwords and messages.

"The attackers probably got some sensitive information and … [schools] don't want this information out online," she says.

Many schools are urging users to be on high alert for any unsolicited emails or messages that appear to come from Canvas, especially those requesting login credentials, as Georgetown University warned. The University of Amsterdam — which says it's one of 44 Dutch educational institutions affected — also recommends people change their passwords on any other sites where they use the same one.

Tobac also recommends using a password manager — to generate long, random passwords for each login — and turning on multi-factor authentication for all online accounts, not just Canvas. She says any student or professor who gets a suspicious call, text or email should "use another method of communication to verify what is authentic."

"Even if there was no breach yesterday, I would say these are the things that I recommend you do," she adds, urging people to "be politely paranoid."

The breach disrupts finals, highlights vulnerabilities

Several schools affected by the breach have already postponed or outright scrapped some final exams, with others warning students and professors that they might need to do so.

The University of Illinois is postponing all final exams and assignments scheduled through Sunday. Penn State canceled certain exams scheduled for Thursday night and Friday, saying it was working with faculty to "determine next steps for final grading" and urging students to check their emails (not Canvas) regularly in the meantime. And Baylor University delayed Friday exams and asked all faculty to send students "whatever study materials they have on their local computers to students as soon as possible."

The breach has underscored how much of academia relies on a single, centralized platform.

Linker, of UPenn, told NPR that he received an influx of panicked messages from students on Thursday afternoon when they suddenly couldn't access PowerPoints, readings and previous exams as they tried to study for Monday's final.

"The problem with using a platform like Canvas is that most [students] are not going to have the readings available printed out or on their laptops," he explains. "It all lives on the online platform, and if that platform goes down, they have no way to access them."

He told students on Thursday that he would upload the course materials to another platform (like Dropbox or Google Docs) if Canvas access wasn't restored by Friday morning. Fortunately, he says, it came back online shortly before 9 a.m. ET.

But Linker says he has concerns about relying fully on Canvas in the future.

"Given what this has exposed, the vulnerability involved and also the concern with the data breaches, I'm starting to rethink whether this is really a wise way to proceed," he says.

One example of that is grading. Linker says Canvas makes it so easy to calculate and weigh students' scores — on individual assessments and overall — that it's come to function as a digital grade book. Going forward, he says he may start keeping an analog record of students' grades just in case.

While Canvas does have competitors like Blackboard, Linker says he doesn't think any would be less vulnerable to a future breach. And Tobac agrees.

"The problem is not that this one website had this cyber event, right? Because nothing in this world is unhackable," she says. "The thing that we have to think about is disaster recovery: How do we continue doing business when there is a cyber event, and how do we do our very best to keep the bad actors out?"

Tobac says this week has shown that many institutions did not have a clear plan for how students and professors can be in touch and access course materials without Canvas. She said those plans should vary based on schools' different circumstances and schedules — which might explain why some are proceeding with finals as usual while others are scrapping exams altogether. But she'd like them to approach the immediate aftermath with one common goal.

"We have to treat people with dignity and respect," Tobac says. "And I hope that that is something that the institutions do, within their timelines and constraints."
Copyright 2026 NPR

Updated November 13, 2026 at 20:38 PM ET

The nationwide ground stop that paralyzed the U.S. aviation system on Friday has ended, according to the Federal Aviation Administration.

The rare stop, which lasted about four hours, grounded thousands of flights at all U.S. airports in one of the biggest disruptions of the nation's air travel system since the September 11th attacks. 

In a Friday night news conference, Transportation Secretary Sean Duffy said that air traffic control facilities had experienced "intermittent" outages of their radar and communications systems beginning earlier in the afternoon. Duffy blamed outdated technology for the failures. 

"We have old switches, old routers. We use 1980s little copper lines. It's an old system that went down and went down everywhere. It got overloaded," he said.

But when pressed by reporters on exactly why those systems would become overwhelmed on an otherwise normal travel day, Duffy did not have a ready answer. 

Homeland Security Secretary Markwayne Mullin joined Duffy in the White House briefing room and said there was no evidence the issue was due to an attack.

"We have seen zero evidence this is a cyber attack," he said.

A flight board showing delayed flights is pictured at Ronald Reagan Washington National Airport, Friday.

(

Tom Brenner

/

AP

)

As of 9 p.m. ET, more than 8,000 flights had been delayed Friday and 7,000 had been canceled in the U.S., according to FlightAware, a flight tracking site. The turmoil comes on the heels of nearly 7,000 flight delays on Thursday.

The FAA said the issue affected Air Route Traffic Control Centers — the regional air traffic control centers across the country that handle high-altitude traffic.

FAA leaders did not brief the media at the White House press conference, and did not provide any further detail on the communication outages that led to the ground stop.

This was only the second nationwide ground stop since September 11, 2001. The U.S. last issued a ground stop of this scale in 2023, when all U.S. airports were shut down due to an outage in the NOTAM (Notice to Air Missions) system, which alerts pilots and airports of real-time hazards.

That outage prompted fears of a cyberattack, but the FAA later determined the issue was caused when contract workers inadvertently deleted critical files.

Senator Richard Blumenthal (D-CT) released a statement late Friday evening calling for a "prompt, penetrating investigation" into the causes of Friday's ground stop.

"A widespread communication outage of this scale is highly alarming — a clear danger to national security, as well as safe, convenient travel close to the holidays. The Department of Transportation owes Americans credible, accurate action and factual disclosure," the statement read.

The FAA has recently begun rolling out an AI-enhanced software tool known as the SMART system as part of its ambitious overhaul of the nation's air traffic control system. But Air Space Intelligence, the company that makes the tool, quickly dismissed speculation that its product could be connected to the flight disruptions.

"The current ground stop is not based on or a result of the SMART system, any product of ASI or our integration with FAA and ATC," the company said on social media.

Passengers stranded

The nationwide ground stop caused chaos in airports and headaches for travelers — many of whom are already too familiar with flight delays and cancellations during the holiday season.

At the Friday night press conference, Duffy said flights would resume but would take time to clear.

At Dallas Fort Worth International Airport, Regina Harling said she waited hours — long past when her flight was supposed to depart — before she learned of the nationwide grounding by checking the news on her phone. 

"There's still a sign right in front of me that says we're boarding in 16 minutes," she said Friday afternoon. 

An airline worker shows people how to apply for a refund at LaGuardia airport on Friday.

(

Adam Gray

/

Getty Images

)

Harling needed to travel last minute to San Diego for a family emergency. Stuck at the airport, she said she was thinking about how soon she could make it to her family, but she's not optimistic.

"I was just thinking to myself that it always feels like it's getting harder to travel than it used to be," she said.

At Chicago O'Hare International Airport, Giliann Karon was on board a plane when the ground stop was ordered. Karon said she had already experienced a flight delay the day before due to bad weather in New York City, where she is heading.

"It's just kind of like, 'Oh, of course this is happening,'" she said.

Deepa Shivaram contributed to this report.

Copyright 2026 NPR

The nonprofits that run the Los Angeles region's federally funded homeless shelters, outreach teams and housing services will soon be overseen by a different government agency, under a deal a federal judge says he plans to approve next week.

If approved, the shift will mark the biggest change in the control of federal homeless dollars in L.A. in decades.

The proposed settlement would shift federal grants and duties from the troubled L.A. Homeless Services Authority (LAHSA) to the county government in stages, starting next month. LAHSA’s management of federal dollars for homeless services would end in June. The deal between LAHSA and the Trump administration keeps the region's request for roughly $240 million in new annual federal funding on track and adds tighter checks on how that money is spent.

U.S. District Judge David O. Carter said at a Friday hearing he would likely sign it Monday, ending LAHSA's lawsuit over the Trump administration’s June suspension of the agency.

“This has been an absolute past dereliction of duty by the federal government” and local governments, Carter said, referring to what he called decades of failure to properly oversee homelessness dollars.

“I choose now to turn this back to the proper governing bodies,” Carter said. "But please, this can never happen again."

Citing past audits and reports, Carter said “HUD’s been on notice since 2007” of LAHSA’s oversight failures and “abandoned” its own oversight role.

“I termed it a partnership in failure,” he added. “Local government turned an absolute blind eye to the distribution of these funds and transparency and accountability for these funds.”

“And what is so sad and disappointing is, these funds were meant to serve the absolute most vulnerable in our society,” the judge added.

U.S. District Judge David O. Carter, left, shown in West L.A. on Wednesday, Aug. 21, 2024.

(

Brian van der Brug/Los Angeles Times via Getty Images

/

Los Angeles Times

)

LAHSA has faced major problems in recent years. Last year, an LAist investigation found the signature of LAHSA’s then-CEO, Va Lecia Adams Kellum, finalized a $2.1 million contract with the nonprofit where her husband was working in senior leadership, despite previously telling LAist she was “completely recused.”

LAist also found the agency kept awarding millions in contract renewals to another nonprofit even after LAHSA’s own compliance team labeled it “high-risk” for, among other things, billing for services while reporting no enrolled participants. That group’s leader, Alex Soofer, recently pleaded guilty to diverting $2 million. Another nonprofit operator contracted with LAHSA, Michael Young, was arrested and charged by federal prosecutors with misappropriating millions of tax dollars, including allegedly siphoning $1 million into a high-end nightclub.

Additionally, a 2024 L.A. County audit found LAHSA had mismanaged hundreds of millions in contracts for homeless services, often paying service providers late and failing to track whether services were provided.

Under the deal, Carter would receive quarterly reports on progress and could intervene if one of the parties asks him to resolve a dispute.

When control would shift

The deal, on its own, does not change which nonprofits provide shelter, outreach and housing. It instead changes which government agency pays them and ensures they’re serving people as required.

Here’s what the timeline will be if Carter follows through on approving the deal:

• Within two weeks of this year's federal awards: Most new grants awarded to LAHSA will instead be managed by the county, not LAHSA.
• Starting Dec. 1: Grants for programs that begin on or after that date move to the county before they start.
• January 2027: LAHSA, which has overseen the homeless counts since 2005, runs the annual homeless count one last time. The county runs it after that.
• By March 1, 2027: The county is approved to take over as the agency that applies for federal homelessness money for the whole region going forward, instead of LAHSA.
• By April 1, 2027: The county takes over management from LAHSA of many federal grants for programs already underway that continue past June 2027.
• By June 30, 2027: LAHSA finishes administering federal grants that end by this date.
• By Dec. 31, 2027: The county takes over the region’s federally required database, known as HMIS, that tracks which homeless services each person receives. The county also takes over another system, known as CES, that matches people with taxpayer-funded housing. With that, LAHSA's last remaining federal roles end.
• January 2028: The county conducts the annual homeless count, taking over that role from LAHSA.

What the deal would mean for services

The federal government’s attorneys said the goal is to have stronger oversight over homelessness spending, after many years of documented failures by LAHSA. Attorneys who struck the proposed settlement said in court Friday that the timeline was structured to ensure a smooth transition that doesn’t disrupt homeless services.

The HMIS database and matching system, which caseworkers use to track clients and place them in homes, will switch over last to avoid disrupting services, said Shayla Myers, the lead attorney for the L.A. Continuum of Care, the body that coordinates federal homelessness funding and joined LAHSA in the lawsuit.

For taxpayers, the deal adds safeguards on spending Carter has demanded for years. LAHSA must send invoices and spending records to the U.S. Department of Housing and Urban Development (HUD) before drawing grant money, and submit receipts afterward. A HUD contractor, Guidehouse, will review its books, and the county must follow the same rules for older grants it inherits. The parties will report to Carter every three months, until LAHSA no longer has any federal roles overseen by HUD.

Bill Essayli is the first assistant United States attorney for the Central District of California.

(

Allen J. Schaben

/

Los Angeles Times via Getty Images

)

First Assistant U.S. Attorney Bill Essayli, whose office represents HUD, told LAist after the hearing that the county is probably the best equipped to take over, and scrutiny will be crucial.

“Do I have amazing confidence in the county? No,” he said, noting that LAHSA is a joint city-county agency.

“But we're going to verify that they are going to be good stewards of the tax money.” With LAHSA gone, he added, “The buck's going to stop at the county.”

Under the proposed deal, LAHSA agrees to cooperate fully with HUD's investigations. A LAHSA attorney told the judge on Friday the agency is cooperating fully with criminal investigations, adding that it was critical that HUD agreed not to reinstate LAHSA’s suspension, so that it can continue to manage federal dollars until they’re handed off.

Judge wanted more 'teeth' for the court

Carter spent much of the hearing asking attorneys for the parties what power he would have to enforce the deal after signing. The proposed settlement lets him settle disputes and receive reports, but he said that left him looking over shoulders without the authority to actually enforce it.

“I have no jurisdiction. I have no teeth,” he said.

He read aloud from 2024 hearings in a related lawsuit, known as L.A. Alliance, where he warned that bills without supporting documents should not be paid. Essayli said that the proposed settlement would be binding “and we'll vigorously enforce it.”

Myers said the deal gives the court oversight to ensure that the problems federal authorities flagged “don’t exist.”

Carter asked to have the ability to hire an expert, at about $150 an hour paid by HUD, to help him understand the quarterly reports on implementing the deal that transfers federal roles from LAHSA to the county. Essayli agreed.

How the case got here

HUD suspended LAHSA from federal funds on June 11, citing alleged failures in the agency’s financial management and conflict-of-interest safeguards. The move put roughly $240 million in expected federal homelessness funding for the region in limbo and held up federal funding HUD had already awarded.

LAHSA, which is overseen by the city and county’s elected officials, sued.

In August, Carter blocked the suspension, writing that LAHSA and HUD had been in “a joint partnership in failure,” and ordering a competition for LAHSA's federal roles. He deferred the selection to the continuum of care — the body designated by federal law to make that choice.

In October, the continuum chose the county for all four, over objections from L.A. Mayor Karen Bass and several City Council members who wanted the city to share control. The city then reached a tentative side deal giving it access to data on unhoused residents and a role placing people in city-funded housing.

What happens next

Carter said he expects to sign the proposed settlement on Monday.

Myers said the deal lets the region “build a peaceful transition of power.”

Left-leaning candidates running in three school board contests flagged by EdSource as races to watch are each leading comfortably in unofficial election results more than a week after a so-called “blue tsunami” swept the country.

Unofficial results also show progressive candidates ahead in some races in the Inland Empire, a conservative stronghold where several far-right school board candidates ran on issues such as gender identity and parents’ rights. Counties have until Dec. 3 to certify election results.

In the Orange Unified School District, four moderate incumbents are far ahead of conservative challengers in separate races. One of them, board President Stephen Glass, defeated challenger Jack Chang, and has declared victory. The conservative candidates ran largely on parents’ rights and fiscal responsibility.

“We won,” Glass said on social media. “We’ll keep putting students first and supporting every teacher, every classified professional and every family.”

All four incumbents are up by double-digit percentage points, Orange County election results show. The election follows last year’s recall of two conservative school board members.

In a race for the Davis Unified school board, an anti-transgender candidate who once stripped down to a bikini at a school board meeting, lost decisively, according to unofficial election results. Beth Bourne, president of the Yolo County chapter of Moms For Liberty, trails incumbent Elizabeth Moon by 89 percentage points, results show.

In Palo Alto — where issues over academics dominated the race — newcomers Avery Wang and Linda Henigin are ahead in unofficial results for two seats. John Craig, who ran in tandem with Wang, conceded on election night. Wang ran primarily on retaining academic rigor, especially in math. “It’s the beginning of a movement,” Wang told Palo Alto Online.

Henigin ran on a platform of improving student well-being following a recent spate of student suicides.

Elsewhere in the state, school board candidates in conservative strongholds such as Chino Valley and Temecula fared poorly in local school board races.

In Temecula, school board President Joseph Komrosky trails challenger David Sola by 10 percentage points, results show. Sola has declared victory. Komrosky had voted to ban critical race theory in district schools and attempted to ban teaching materials that mentioned slain gay rights icon Harvey Milk, drawing a sharp rebuke from Gov. Gavin Newsom.

Komrosky’s apparent defeat was part of what The Press-Enterprise reported as “a seismic shift in local governance given recent elections that gave power to the Christian right.”

In Chino Valley Unified in San Bernardino County, two conservative school board candidates are trailing far behind, results show. Chris Shaw, the husband of State Superintendent of Public Instruction candidate Sonja Shaw, trails Frank Gerdine by nearly 17 percentage points, while Meagan Lichthart is ahead of Shaun Smith, backed by Shaw, by 15 percentage points.

This story was originally published by EdSource.

Major service cuts to Metrolink are on hold for now thanks to a $20 million grant from California’s State Transportation Agency. The Metrolink board of directors approved the agency’s $420 million budget on Friday.

The previous budget proposal included slashing a third of weekday trains and 40% of weekend trains.

“Thankfully, our customers were spared the disappointment and frustration of losing the service they rely on to travel the region for business and pleasure,” Tom Schamber, chief financial officer at Metrolink, said at the board meeting.

How did we get here? 

The Metrolink budget had been approved quarterly since June as staff worked out the annual budget.

Metrolink staff have worked on this year’s budget since last September. The agency has pointed to slowing fare revenue, rising costs due to inflation and low ridership numbers for its budget troubles.

“Fare box revenue ended the year $14 million under budget. This was sobering, and we realized that not only was fiscal [20]26 off, but our ridership expectations for fiscal year [20]27 would need to be recalibrated to this new baseline,” Schamber said.

A majority of Metrolink’s budget is funded by Orange, Los Angeles, Riverside, San Bernardino and Ventura counties’ transportation agencies. For more than a year, Metrolink officials have been building a budget that member agencies, like the Orange County Transportation Authority and L.A. Metro, would approve.

L.A. Metro and OCTA cut their subsidies to Metrolink by 3% and 10%, respectively.

“The challenges ahead of us were becoming more evident,” Schamber said at Friday’s board meeting. “In addition to disappointing fare revenue and funding limitations, we must absorb inevitable cost increases in several of our largest contracts.”

What we know about the grant

The $20 million grant from the state comes with the expectation that Metrolink will retain the same service levels provided today, Schamber added.

Metrolink CEO Darren M. Kettle said another expectation is that the agency must plan to maintain its services for the upcoming year.

“We don't have a plan. We're working on a plan to make sure we have the funding to deliver the same level of service at a minimum,” Kettle said. “With respect to these conditions, based on what we know now, as of last evening, our staff is confident that Metrolink will be able to meet these conditions.”

What’s next? 

Kettle said staff got a head start on next fiscal year’s budget through the state grant application. Officials said the rail agency is also gearing up for the 2028 Olympic Games.