Two questions crossed against each other for all fifty states: did the state receive iceberg lettuce that Taylor Farms de Mexico recalled on July 17, and does the state publish a 2026 Cyclospora count of its own.

CDC published its weekly surveillance update on Tuesday, July 28, and it finally answered the two questions this map had been unable to answer for a week. How many states, and how many hospitalizations. The answers are 45 statesand 423 hospitalizations, against 6,707 laboratory-confirmed domestic cases for the period May 1 through July 27. The agency updates that page once a week, on Tuesdays, so those figures stand until August 4.

Hold those next to what the same agency says on a different page. CDC’s outbreak page still reads nine states and at least 98 hospitalizations, and it has read that since July 24. One arm of CDC says 45 states and 423 people were sick enough to be admitted to a hospital, and another arm of CDC says nine and 98. Both numbers are current. Both are correct. They differ by more than a factor of four because they are answering different questions, and only one of those questions was ever about a parasite. The other was about whether you ate at a Taco Bell. CDC says so in its own footnote: the 1,947 counts people who ate at a Taco Bell in one of the nine states, including people who were only traveling through.

The surveillance page carries 6,707 laboratory-confirmed domestic cases, up roughly 2,500 from the July 21 update, plus more than 11,500 more that are not laboratory confirmed or still need international travel ruled out. The state count went from 41 to 45 in that same week. Sick people range in age from 1 to 98. No one has died. The agency estimates a six-week lag between when somebody gets sick and when the case reaches Atlanta, which means every one of these figures describes a June that is already over.

Here is the arithmetic. Add CDC’s own two figures together and the agency is describing 18,207 people, which is how the American Hospital Association reported it. Add up what all fifty states publish about themselves, one state at a time, and the total is 18,687. Those two numbers were built by completely different methods, and they land within about two and a half percent of each other. Two independent counts of this outbreak now agree on roughly eighteen and a half thousand people. The number the government calls the outbreak is 1,947. That is under eleven percent of it.

Five states moved on this table since last night, and every one of them moved up. Kansas nearly doubled in a week — KDHE reported 461 cases on Wednesday, up from 289, with 20 hospitalized, 405 of those cases in July alone, and roughly 190 interviews still pending. West Virginia is at 245 with 19 hospitalized as of July 28, not the 226 this table carried. Illinois is at 532 and Pennsylvania is at 82, per CNN’s tracker as of Wednesday. And Florida jumped to 254 in Thursday’s state report, covering illnesses through July 25, up from 158 a week earlier. Its weekly series since May 1 now runs 50, then 96, then 158, then 254. Pennsylvania is worth pausing on too. Cyclosporiasis is not a reportable condition there — CDC’s own footnote says Pennsylvania cases are reported voluntarily — and it still nearly doubled.

Michigan is unchanged at 10,077 since Wednesday, up 397 in a day, in a state that identifies about fifty cases in an ordinary year. But MDHHS attaches a caveat to its own numbers that deserves to travel with them: the July 27 total included roughly 475 cases that had not previously been reported to the state because of delayed laboratory reporting, and the department says plainly that those do not reflect a sudden increase in illness. Some of this curve is the parasite. Some of it is the laboratory catching up. Anyone quoting a daily jump should say which. Michigan has now completed more than 2,000 interviews and calls the evidence pointing at Taylor Farms shredded iceberg very strong.

In Ohio, the regional number has now passed the state one. The Toledo-Lucas County dashboard reports 2,856 cases across northwest Ohio and 1,183 in Lucas County as of Wednesday. The Ohio Department of Health’s statewide figure is 2,574 and has not moved since July 24. A corner of Ohio is reporting more illness than Ohio.

Which raises the thing I want to flag about this table rather than bury in it. Fourteen of the fifty numbers below trace to a single national roundup, and that roundup has not been updated since July 17. Its Michigan entry still says 4,312. Its Ohio entry still says 177. Those two states have since gone to 10,077 and past 2,500. There is no reason to think Arizona, Colorado, Georgia, Iowa, Louisiana, Maryland, Massachusetts, Minnesota, Nebraska, Rhode Island, Tennessee, Utah and Wisconsin are frozen in real life; they are frozen in the only public record I can find. Nebraska is the clearest example: it sits here at 49 from July 17, and on Wednesday the Lincoln-Lancaster County Health Department alone reported 33 cases in July, 30 of them acquired in this country, and said that is above what it normally sees. One county is most of the state’s published total. Every one of those fourteen numbers is a floor.

The nine outbreak states now hold 15,834 of the 18,687. CDC’s outbreak count for those same nine states is 1,947. That leaves 13,887 people who are sick with this parasite, in the nine states the government has already named, who are not in the number the government publishes — because they apparently did not report eating at a Taco Bell. Eighty-seven percent of the illness inside the outbreak states still sits outside the outbreak count.

The other sixteen dark-green states — the ones that received recalled Taylor Farms lettuce but are not among the nine — report 1,816 between them. Seventeen of those 1,816 have a named source (Taylor Farms lettuce), and all seventeen of them are in one hospital cafeteria in Keene, New Hampshire.

One honest limit on the number at the top of this page, before somebody else raises it for me. CDC’s 6,707 counts only people who did not travel internationally. The fifty-state total does not make that cut, because most states do not publish it. Where they do, the share is not trivial: Florida says 28 of the 158 it was carrying a week ago were acquired outside the country, Virginia says 31 of its 126, Illinois said 96 of 216 in mid-July, and Kansas reported 17 of 55 the same week. The eleven light-green states are the most exposed to this, because they are light green precisely for the reason that the recalled lettuce never reached them, and New York is 666 of their 1,037. That makes 18,687 a count of reported cyclosporiasis, not a count of domestically acquired cyclosporiasis, and I am not going to pretend otherwise.

It cuts the other way too, and harder. CDC estimates a six-week lag between illness and report. Cyclosporiasis is missed unless a clinician specifically orders the test for it, which is why CDC calls it underdiagnosed and underreported in its own health advisory. And none of these numbers include the people who got sick, stayed home, and got better. The comparison that survives all of it is the one inside the nine outbreak states, where state-reported illness is measured against state-reported illness: 15,834 against 1,947. Nothing about travel, lag or testing explains a gap that size, because both halves of it were counted the same way.

There is one more thing in the July 28 update worth sitting with. CDC now says 45 states have cases. Only 36 states publish a count of their own. That leaves at least nine states where the federal government knows there are confirmed cases and the residents of those states cannot look up how many. On the map below they are hatched, and hatching has never meant no illness. It has only ever meant no answer.

And we can now name some of them. The four states CDC added going from 41 to 45 were Oregon, South Dakota, Vermont and Delaware. Three of those four are hatched on the map below, which is to say the federal government has confirmed cases in South Dakota, Vermont and Delaware and none of those three health departments publishes a number. A resident of Dover who wants to know how much of this is in Delaware has to read a CDC surveillance page to find out that the answer is not zero, and still cannot find out what it is.

Every case number below, the color it produced, and a link to where it came from. Where a state publishes on a fixed schedule, that schedule is noted, because a number is only as fresh as the day its agency next opens the file.

A dark-green state is not a state where the lettuce is proven to have sickened anybody, and a light-green state is not a state where it is proven not to have. The map shows where product went and where illness was counted. What it keeps showing, six redraws in, is that the government’s outbreak number is not tracking the outbreak. It is tracking the questionnaire. CDC moved its own state count from 41 to 45 this week and its hospitalization count from something it would not publish to 423. Four more states moved yesterday. The outbreak page has not moved since July 24. Nor is the nine-state cluster the only thing open: on July 29 FDA raised a separate Cyclospora investigation with no identified source from 72 cases to 93.

CDC’s surveillance page now reports 6,707 laboratory-confirmed, domestically acquired cases of cyclosporiasis since May 1, across 45 states, with 423 hospitalizations. Run that figure through the federal government’s own foodborne illness burden model and the number of Americans who actually got sick this summer is 557,352.

The multiplier comes from Scallan et al., the 2011 CDC study that remains the only published United States burden estimate specific to this parasite. Its expanded tables assign Cyclospora an underdiagnosis multiplier of 83.1. For every laboratory-confirmed case, the model assumes roughly eighty-three people were infected and never counted. The 83.1 is built from four sequential filters: whether a sick person seeks care, whether a specimen gets submitted, whether the laboratory tests for this organism, and whether the test finds it.

A word about why the base number here is 6,707 and not 18,347. Add up what all fifty states publish about themselves and the total is 18,347 people. That is a real number, and I have spent two weeks assembling it. It is the wrong number to multiply. The 83.1 exists to estimate the people nobody found, and it operates on laboratory-confirmed cases only. CDC’s own accounting splits this summer into 6,707 confirmed and more than 11,500 not confirmed. Those 11,500 are precisely the population the multiplier is designed to conjure into view, and they have already been conjured. Multiplying the full 18,347 by 83.1 counts them a second time and produces 1,524,636, a number I could publish and could not defend. The 11,500 are already inside the 557,352.

Now the part nobody writes about. What does one of those people put into the world?

The Global Water Pathogen Project, the UNESCO reference series for waterborne pathogens, puts the concentration in stool at one hundred to ten thousand oocysts per gram. The Merck Manual sets normal adult stool output at 100 to 200 grams a day and defines diarrhea as anything above 200 grams, with large-volume diarrhea running past a liter. Take a conservative band of 300 to 1,000 grams a day for someone with watery diarrhea. One sick person is therefore passing somewhere between thirty thousand and ten million oocysts every day.

Then there is duration. In the only controlled treatment trial ever run on this parasite, in Peruvian children, untreated infections shed for a mean of 12.1 days. Antibiotics cut it to 4.8. Most Americans sick this summer were never diagnosed, which means they were never treated, which means they are on the twelve-day curve. A single untreated case sheds somewhere between three hundred and sixty thousand and one hundred and twenty million oocysts over the course of one illness. Multiply that by 557,352 people and you get a figure with somewhere between eleven and fourteen zeros in it. I am not going to print that number as though it means something. The range is a direction, not a measurement.

Which brings us to the question I had not thought hard enough about until it was put to me. Where does all of it go?

Into the sewer, and this is where the story stops being about Michigan. Every oocyst leaving an American body this summer is unsporulated and non-infectious and needs one to two weeks in the environment before it can infect anybody. Nobody in Michigan is a danger to anybody in Michigan. What matters is whether these things survive the trip.

They partly do. The World Health Organization’s own background document on this parasite reports that activated sludge treatment removes Cyclospora only partially, and that treated effluent can still carry viable oocysts. It cites an Arizona study that found the parasite by molecular methods in a quarter of wastewater plant influent samples and in thirteen percent of effluent samples, and an Italian study that found it in twenty-one percent of treated wastewater. A plant running tertiary treatment with membrane filtration still put it in thirteen percent of its effluent. Conventional municipal wastewater treatment is not a barrier to this organism. It is a partial filter.

And then the finding that answers the amplification question directly. The same Italian work reported that soils irrigated with wastewater effluent were more likely to be contaminated with Cyclospora than soils that were not. That is the loop, documented: sick people shed into sewage, sewage is treated incompletely, effluent reaches land and water, and the parasite is found in the ground where food grows. 

The honest limit on all of this is that in the United States the loop mostly does not close. American produce is not generally irrigated with municipal effluent, and the parasite that sickened eighteen thousand people this summer was shed by somebody else, somewhere else, in April or May. But the loop closes wherever effluent and irrigation water meet, and the produce industry has been funding research on exactly that for a decade. The Center for Produce Safety has put $1.6 million into Cyclospora work since 2014 and reports that the results confirm the parasite is endemic in the United States and recoverable from wastewater and irrigation water, posing a significant risk of produce contamination. A CPS and USDA project run by Charles Gerba’s group at Arizona names the mechanisms outright: failing septic systems, compromised sewer pipes, and treated wastewater effluent discharged into surface waters used to irrigate food crops. A two-year study in southeastern Georgia published last year confirmed the parasite by sequencing in nine percent of municipal wastewater sludge samples.

Yes, we are creating a pot full of parasites, and the arithmetic behind that phrase is real. But the pot that matters is not the one under Michigan. It is the one under whatever field grew the lettuce, filled by people whose names nobody knows, in a watershed nobody sampled, weeks before the first American got sick. We have spent this summer counting the output of this outbreak with extraordinary care. Nobody has gone looking for the input.

Michigan crossed ten thousand this morning. MDHHS reported 10,077 cyclosporiasis cases since June 22, up from 9,680 on Tuesday. A state that identifies about fifty cases in an ordinary year has now identified two hundred years of them in five weeks, and 160 of those people were sick enough to be hospitalized.

The federal outbreak number did not move. CDC’s outbreak page still reads 1,947 people in nine states with at least 98 hospitalizations, and it has read that since July 24. Every one of the 1,947 qualified by reporting exposure to a Taco Bell.

CDC’s surveillance page is the other federal number, and it is a different animal: 6,707 laboratory-confirmed domestic cases since May 1, plus more than 11,500 more that are not laboratory confirmed or still need international travel ruled out. The agency says it is now publishing that page weekly, that it estimates a six-week lag between when somebody gets sick and when the case reaches Atlanta, and that the illnesses in the series began on May 1 with a median onset of July 2. The outbreak definition starts June 22.

Here is the arithmetic that made this morning worth redrawing the map for. Add up what all fifty states publish about themselves and the total is 18,209. Add CDC’s own two figures together and you get something north of eighteen thousand two hundred. The fifty-state hand count and the federal government’s own numbers have converged. They are not measuring the same thing and they never were, but they are now describing a population of the same size — while the number the government calls the outbreak sits at 1,947, which is under eleven percent of it.

Two things changed on the map since Tuesday. Michigan went from 9,680 to 10,077. And Florida is corrected from 106 to 158 — the 106 was a stale figure sitting in a wire roundup, while Florida’s own health department has reported 158 since May 1 across 36 counties, with Miami-Dade highest at 33. Florida averaged 246 cases a year from 2015 through 2025, so 158 by mid-July is not by itself alarming; it is simply not 106.

Which raises the thing I want to flag about this table rather than bury in it. Fourteen of the fifty numbers below trace to a single national roundup, and that roundup has not been updated since July 17. Its Michigan entry still says 4,312. Its Ohio entry still says 177. Those two states have since gone to 10,077 and past 2,500. There is no reason to think Arizona, Colorado, Georgia, Iowa, Louisiana, Maryland, Massachusetts, Minnesota, Nebraska, Rhode Island, Tennessee, Utah and Wisconsin are frozen in real life; they are frozen in the only public record I can find. Every one of those numbers is twelve days old and every one of them is a floor.

The nine outbreak states now hold 15,452 of the 18,209. CDC’s outbreak count for those same nine states is 1,947. That leaves 13,505 people who are sick with this parasite, in the nine states the government has named, who are not in the number the government publishes — because they did not report eating at a Taco Bell. Eighty-seven percent of the illness inside the outbreak states sits outside the outbreak count.

The other sixteen green states — the ones that received recalled Taylor Farms lettuce but are not among the nine — report 1,720 between them. Seventeen of those 1,720 have a named source, and all seventeen of them are in one hospital cafeteria in Keene, New Hampshire.

Two questions crossed against each other for all fifty states: did the state receive iceberg lettuce that Taylor Farms de Mexico recalled on July 17, and does the state publish a 2026 Cyclospora count of its own.

Every case number on the map, the color it produced, and a link to where it came from.

A green state is not a state where the lettuce is proven to have sickened anybody, and a blue state is not a state where it is proven not to have. The map shows where product went and where illness was counted. What it keeps showing, four redraws in, is that the government’s outbreak number is not tracking the outbreak. It is tracking the questionnaire.

Hello from the last day at IAFP and there should be no surprise the Cyclospora has been the topic of a few conversations.

Two and a half months into the largest outbreak of cyclosporiasis ever recorded in this country, it is worth stopping to separate what has actually been established from what is merely being assumed, and from what nobody has bothered to go find out. The first list is shorter than you would expect. The third is longer.

Start with what we know. We know the scale, roughly. CDC’s surveillance page reports 6,707 laboratory-confirmed domestically acquired cases since May 1, with more than 11,500 additional illnesses still awaiting confirmation or travel history. That is somewhere near eighteen thousand people. Add up what the fifty states report on their own websites and the floor comes to 17,812. The two numbers, arrived at by completely different routes, land in the same neighborhood. For comparison, CDC’s notifiable disease tables put the entire United States at 3,952 cases for all of 2025 and 4,210 for all of 2024, travel-associated illnesses included. This year has already produced four or five times a normal year, and the season is not over.

We know where most of the illness is. Michigan alone reports 9,680 cases and 160 hospitalizations, which is roughly two and a half times a normal national year in one state. Ohio, North Carolina, Illinois, Indiana, New York, Oklahoma, West Virginia, Arkansas and Missouri all report totals in the hundreds or thousands.

We know the vehicle for one slice of it. Epidemiology and traceback both point at iceberg lettuce from Taylor Farms de Mexico, processed at the company’s plant at Doctor Mora in Guanajuato. Michigan interviewed 190 Taco Bell patients and about ninety percent of them had eaten iceberg. FDA’s traceback converged on a single independent farm. The company recalled all iceberg sourced from central Mexico on July 17 and suspended sourcing from the region for the remainder of the growing season. No product sample has ever tested positive; the one that did on July 18 was withdrawn the next day as a false positive, which is ordinary for a parasite that cannot be cultured and that rides on perishable produce already eaten weeks before anyone tests it.

We know exactly what the federal outbreak number is and is not. CDC counts 1,947 people in nine states with 98 hospitalizations, and every one of them is a person who tested positive and reported eating at a Taco Bell. FDA says the same thing in its own words, describing the nine states as the places cases with Taco Bell exposure have been reported. That number has not moved since July 24.

We know the recalled product went a great deal further than Taco Bell. Recalled lettuce was distributed to foodservice customers in twenty-seven states between June 29 and July 16, and to Walmart under the Marketside brand. The Packer reported that the implicated lettuce was produced as five-pound bags at the Guanajuato plant, and that Sysco distributes those bags to hospitals, ballparks and fast-food chains. Jack in the Box said recalled product reached its stores in Texas, Oklahoma and Louisiana, and Consumer Reports pointed out that the foodservice destination of most of this lettuce appears in FDA’s version of the recall notice and not in the company’s own.

We know that exactly one state has connected an illness to that product outside the Taco Bell count. New Hampshire named Taylor Fresh Foods in its own press release on July 23, tied seventeen cases to the cafeteria at Cheshire Medical Center in Keene, and published the street address. Eighteen other states received the same lettuce and have named nothing.

And we know this has happened before, at the same place. In 2013 a Cyclospora outbreak that sickened more than six hundred people in twenty-five states was traced to Taylor Farms’ Guanajuato operation. FDA allowed the plant to resume shipping after the company pledged to routinely test both its products and its water supplyfor the parasite and to monitor sanitary conditions. Thirteen years later, no result from that program has ever been made public.

States that received Taylor Farms lettuce: 16,775 Cyclospora cases across 28 states.

States that did not: 1,037 Cyclospora cases across 22 states.

That is the known column. Here is the other one, and it is where the real story is.

We do not know how many people are sick. Not approximately, and not within a factor of three. CDC’s own confirmed figure and its own pending figure differ by a factor of nearly two, the agency has not attached a state count or a hospitalization count to the new 6,707, and it will not say which states the cases are in. Beyond that sits the underdiagnosis problem, which is not speculative: the published foodborne burden estimates CDC itself relies on apply a multiplier on the order of eighty diagnosed-to-actual for this parasite, because most people with weeks of diarrhea never get a stool test and most stool tests never look for it.

We do not know how many of the illnesses inside the nine outbreak states Taylor Farms illnesses are. Those nine states report 15,055 cases among themselves. The federal outbreak count is 1,947. That leaves 13,108 people in the outbreak states who are not in the outbreak (although some of the 13,108 could still be added to the 1,947), and nobody in any agency has said publicly how many of them ate recalled lettuce somewhere other than a Taco Bell. The seventeen people in Keene are proof that the category exists.

We do not know whether the other eighteen recipient states have Taylor Farms cases, because for most of them there is no public record of the question being asked. One state has done the work and published a negative: North Carolina reports that its increase does not appear tied to the Taco Bell outbreak, its patients’ most common exposures being parsley, cilantro and lettuce. Nebraska, Rhode Island, New Mexico and Maryland told Reuters they had found no evidence of a link. That is four or five answers out of nineteen states. The rest is silence, and silence is not a finding.

We do not know whether the recall’s own boundaries are the right ones. The recall covers one farm, one commodity and eighteen days of distribution, June 29 through July 16. Those lines were drawn by the company off a traceback, not off the epidemiology. CDC’s surveillance series runs from May 1, with a median onset of July 2 and illnesses beginning eight weeks before the recalled product ever shipped. The outbreak definition itself starts June 22, a week before the window opens. Nobody has published what the Doctor Mora plant sent into the United States earlier in the year, or in 2025, and central Mexico grows lettuce on a season considerably longer than eighteen days.

We do not know how the contamination happened. There is no published 2026 environmental assessment of the plant or the farms that supply it, no water result from the company, and no public explanation of the route by which human waste reached a lettuce field or a wash line. Mexican regulators inspected on July 18 through 20 and reported the plant’s lettuce and water free of the parasite and of fecal coliforms. That is a real finding and it belongs in the record, though it was taken after production had already been suspended and roughly two months after the median onset date. A clean sample in July does not describe a field in May.

Here is what would answer these questions, and none of it requires a new law or a new appropriation.

Publish the denominators. CDC should attach a state list and a hospitalization count to the 6,707 and should say plainly how many states have cases. An agency that will not name the states cannot expect anyone else to find the pattern.

Count the outbreak twice. Report the number of people who got sick after eating at a Taco Bell, which is what the 1,947 measures, and separately report the number of people who got sick after eating recalled Taylor Farms lettuce anywhere at all. New Hampshire has already produced seventeen of the second kind. Publish both numbers and the difference between them becomes visible instead of invisible.

Pull the import records. FDA and Customs know what Taylor Farms de Mexico shipped into this country and when, for all of 2026 and for 2025, not merely for the eighteen days the company chose to recall. If Doctor Mora product was moving in April and May, the public is entitled to know it, because the illnesses were.

Genotype the specimens and publish the cluster assignments. FDA has spent five years building precisely this capability and said out loud what it was for: when it released its Cyclospora action plan in 2021 the agency said it intended to advance genotyping in clinical, food and environmental samples so that clinical cases could be genetically linked to the products and environments identified by traceback. By 2023 it was reporting a targeted amplicon assay that sequences even at low parasite levels. Run the specimens from the May and early June cases, from the eighteen silent recipient states, and from Keene. They either type together or they do not.

Test the water and publish the result. Not as a novelty. FDA detected this parasite in a Florida irrigation canal during the 2020 bagged salad outbreak and then wrote to Florida growers telling them to account for Cyclospora in their operations. The method exists. Which brings back the 2013 promise, and the thirteen years of results nobody has produced.

Make the parasite countable again (we need a hat for that). Cyclospora was dropped from FoodNet in July 2025. Pennsylvania, one of the nine outbreak states, does not make cyclosporiasis notifiable at all, which is why its case count is a voluntary number. The Food Traceability Rule’s lot-level records requirement was supposed to be law on January 20, 2026, four months before the first illness in this outbreak, and enforcement has been pushed to July 2028. Every one of those decisions is reversible.

The distance between the known column and the unknown one is not a mystery of science. Every question in the second list has a method attached to it that already exists and is already funded, albeit underfunded. What separates them is that somebody has to decide to ask. New Hampshire asked one question about one cafeteria and got seventeen answers in a state that ordinarily sees seven cases in a year. There are eighteen thousand people out there and we all want to know.

Start with New Hampshire, because New Hampshire did the thing nobody else has done.

On July 23 the state’s Department of Health and Human Services issued a release under the headline NH DHHS Confirms Nine People with Cyclosporiasis Linked to Consuming Taylor Fresh Foods Lettuce. The company is in the headline. The product is in the headline. The place is in the first sentence — the cafeteria at Cheshire Medical Center in Keene, which served lettuce that Taylor Farms has since recalled.

By Tuesday the nine had become seventeen. DHHS spokesperson Jake Leon told New Hampshire Public Radio that all seventeen are people who ate lettuce at a location serving recalled Taylor Farms product, and that all seventeen trace back to Cheshire. The state is at thirty-three confirmed cases overall, with two people hospitalized.

Then it goes further. New Hampshire’s cyclosporiasis page publishes a list of exposure locations — named establishments, with street addresses, identified as having served recalled Taylor Farms product that may have sickened people in the state. The first entry is Cheshire Medical Center, 580 Court Street, Keene. DHHS says more will be added as the investigation identifies them and says plainly that other New Hampshire restaurants and cafeterias also received the recalled product.

A state health department is publishing an address. No other state in this outbreak is doing that.

Set the number against the baseline and it gets worse rather than better. CDC’s own year-end notifiable-disease table records seven cyclosporiasis cases in New Hampshire for all of 2025 and nine for all of 2024. Seventeen people from one hospital salad bar is roughly two years of New Hampshire, in one cafeteria, in one summer.

And none of the seventeen are in the federal outbreak count. CDC’s outbreak page counts 1,947 people in nine states, and every one of them qualified by reporting exposure to a Taco Bell. New Hampshire is not one of the nine. The lettuce is the same lettuce, and the recall is the same recall; what keeps those seventeen outside the national number is the questionnaire.

Which is the argument the map below has been making all month, and why the map is worth updating rather than replacing.

It crosses two questions against each other for all fifty states. Did the state receive iceberg lettuce that Taylor Farms de Mexico recalled on July 17? And does the state publish a 2026 Cyclospora count of its own? Two questions, four groups, and the groups still do not line up the way a single-source outbreak would predict.

Two of them changed shape since Sunday. New Hampshire came off a published band of one to ten and onto a real number, thirty-three. And Oregon moved out of the silent column — OHA reports twenty-three cases in 2026 against twenty-six in 2025 and thirty in 2024, two of them residents who traveled to outbreak states, with no recalled product distributed in the state. A state publishing a number that looks like an ordinary year belongs on this map for exactly that reason. Blue is eleven states now, and grey is eleven.

Seven state counts moved in the last two days. Michigan 9,680, up 427, though MDHHS says about 475 of Monday’s total were delayed laboratory reports rather than one day’s illnesses. Indiana 954. Oklahoma 303, with 18 hospitalized, up from 172. North Carolina 718 with 24 hospitalizations, 157 more in a week, still naming parsley and cilantro and still not considering itself part of the Taco Bell cluster. Arkansas 92, with 56 of them in Benton County. And northwest Ohio alone is at 2,785, while Ohio has still not published a statewide figure of its own since July 16.

The federal number moved further than any of them. CDC’s surveillance page now reports 6,707 laboratory-confirmed domestic cases since May 1, up from 4,173 a week ago, and says the agency is aware of more than 11,500 additional cases that are not laboratory confirmed or still need international travel ruled out, up from 7,400. That is CDC describing something north of eighteen thousand people. Its outbreak count did not move at all.

Add up what the states publish about themselves and fifty of them report 17,760 people sick, up 1,080 in two days. The nine outbreak states hold 15,055 of that. CDC’s outbreak count for those same nine states is 1,947.

Every case number on the map, the color it produced, and a link to where it came from.

A green state is not a state where the lettuce is proven to have sickened anybody, and a blue state is not a state where it is proven not to have. The map shows where product went and where illness was counted. New Hampshire is the only state outside the nine that has tied illnesses to a Taylor Farms product at a named place — not because the lettuce stopped at its border, but because somebody there asked.

Last week I asked whether the Washington Post had become the CDC. The Post had nine states in this Cyclospora outbreak at five in the morning and the government’s own map still colored in five. Tonight the question is smaller and more embarrassing. Is eFoodAlert the new CDC?

Phyllis Entis posted this evening what I think is the most important development in this outbreak since FDA named Taylor Farms de Mexico, and no federal agency has said a word about it. New Hampshire has now confirmed seventeen cases of cyclosporiasis in people who ate recalled Taylor Farms lettuce at the Cheshire Medical Center cafeteria in Keene. Phyllis is the one who set the significance out in plain type: this is the first time a state or federal health agency has explicitly tied outbreak cases to an establishment that is not a Taco Bell.

Sit with that, because it goes to the thing that has been bothering me all month. CDC’s outbreak count is not a count of people sickened by Taylor Farms lettuce. It is a count of people who got sick and reported eating at Taco Bell. That is a definition, not a finding. A hospital cafeteria in Keene, New Hampshire is not a Taco Bell. The lettuce is the same lettuce. The recall is the same recall. The parasite does not know the difference and the epidemiology never did. What kept those seventeen people outside the national outbreak number was the questionnaire.

New Hampshire is also not a place where seventeen cases disappear into background noise. Over the previous five years the state typically found between two and nine cases of cyclosporiasis a year. It is now at thirty-three confirmed, with two people hospitalized. Seventeen of them ate at one cafeteria.

Phyllis found three more states too, and she found them the hard way, by reading state health department pages one at a time. Oregon reports two residents who traveled to outbreak states before falling ill. Washingtonhas two cases the state is including in the Taco Bell outbreak, both of them residents who ate at a Taco Bell while traveling in Michigan. Arkansas stood at seventy-nine lab-confirmed cases as of Friday and has not said how many of them are travel-linked to the outbreak states. Her question about those cases is exactly the right one, and nobody has answered it: are they counted in the state where the person lives, or the state where the person ate? Because if the answer is neither, they are not counted anywhere.

Arkansas deserves a second look on its own. Fifty of those seventy-nine cases sit in Benton County, in the northwest corner of the state, and state epidemiologist Austin Porter says his team is reviewing case information for food exposures that might connect them to the national outbreak. Every other reporting county in Arkansas is in single digits or barely above. That is a second cluster, in a state that received recalled lettuce, and it is not a Taco Bell either.

Then she does the part nobody is paid to do. Michigan at 9,680. Illinois at 707 confirmed and probable, 411 of them domestically acquired. Indiana at 954. And the line at the bottom of her post that ought to be the headline: CDC last updated its outbreak page and its surveillance page on July 24, and there is no indication of when the next update is coming.

Four days of silence, in an outbreak that has added thousands of cases in three weeks and just crossed into double-digit states.

This is not the first time this month that Phyllis has been out ahead of the agencies. She is the one who looked at CDC’s first published epidemic curve and noticed that it opens at a peak, which is not how epidemic curves work, and that it has two humps fifteen days apart, which for a parasite that cannot spread person to person means two exposures. She is also the one who noticed that CDC’s surveillance table gives Ohio a range of 301 to 500 while the outbreak notice credits Ohio with 639, and gives West Virginia 11 to 30 against 42 in the outbreak. The outbreak is a subset of surveillance. A subset cannot be larger than the set it sits inside. That is not a nuance, it is a contradiction sitting on a government website, caught by a food microbiologist with a WordPress account and no press office.

Her own verdict on the agencies is blunter than anything I would write about people I still hope will pick up the phone: “It’s time to change the locks.”

I have been saying for a while that when the public system goes quiet, somebody else ends up doing the counting. I did not picture it being a blog, a newspaper, a volunteer running a genomics tracker, and a couple of public radio stations in Toledo and Keene. But that is who has the numbers tonight, and the numbers are the whole ballgame. You cannot fix what you refuse to count, and you cannot count what you have defined out of existence.

One more thing, because her post sent me looking. I went and checked her four states against the health departments themselves, and the check turned up something larger than the four. Reuters called around on Friday and got answers worth writing down. Nebraska, Rhode Island, New Mexico and Maryland all said they have found no evidence tying their cases to this outbreak. North Carolina, sitting on 561 cases since May, says its rise does not appear connected to Taco Bell at all, and the exposures its patients keep naming are parsley, cilantro and lettuce. Oregon’s two are travel cases. Washington’s two are travel cases. Arkansas says only that its increase is in part associated with the multistate outbreak, and names nothing and nowhere.

Which leaves New Hampshire standing alone. Cyclosporiasis has been reported in at least forty-one states this year. Outside the nine states in the Taco Bell count, exactly one has tied illnesses to a Taylor Farms product at a named place, and it is a hospital cafeteria in Keene that Phyllis Entis is the reason any of us are talking about. That is not evidence the lettuce stopped at the New Hampshire line. It is evidence that New Hampshire asked a question the other forty did not. NBC News reported this week that Taylor Farms iceberg is unlikely to be the only product making people sick, and FDA’s Irvin says the agency is seeing different signals of outbreak sources. That may well be right. We are never going to find out from a count that recognizes only the people who remember eating at a Taco Bell.

Phyllis Entis has been writing eFoodAlert since 2008. She is a food microbiologist by training and the author of TAINTED and TOXIC, and she posts recalls and alerts on the quiet days, which is the only reason she is ready on the loud ones. Go read her. Go subscribe to her. She has 2,433 subscribers. CDC has a budget.

Hearty shout out, Phyllis. Keep going.

On August 9, 2013, Taylor Farms de Mexico stopped shipping salad mix and leafy greens from Mexico to the United States, and notified FDA three days later. Over the following week FDA, CDC and five Mexican agencies walked the processing plant at Doctor Mora, Guanajuato, and five farms identified by traceback. On August 25 the company started shipping again with FDA’s concurrence. The part worth reading now is not that FDA let it reopen. It is the price FDA set, and what has been done about it since.

That outbreak sickened 631 people across 25 states. Iowa and Nebraska accounted for 239 restaurant-associated illnesses, tied by epidemiology and traceback to bagged salad mix from Taylor Farms de Mexico. Texas reported 278 cases, at least 25 of them linked to Puebla cilantro from an unrelated producer. The cause of more than a hundred others was never determined.

Laboratory-confirmed cyclosporiasis cases by week of illness onset, United States, 2013, with Iowa and Nebraska, Texas, and all other states shown separately. CDC, Morbidity and Mortality Weekly Report, November 1, 2013.

Start with what the company said before the government asked it for anything. On the Friday FDA named Taylor Farms de Mexico, chairman and chief executive Bruce Taylor emailed reporters that the plant already ran an extensive testing program in Mexico covering both water sources and raw product. “All our tests have been negative,” he wrote. FDA noted that its last inspection of the facility, in 2011, had turned up no notable issues.

Two weeks later FDA set the reopening terms. The agency agreed to the resumption on the strength of the environmental assessment and its review of a Cyclospora sampling plan the firm had put in place — a comprehensive program covering leafy greens and other products from its farms and its processing facility, reaching past the leaf to include “both sampling of their products and water”, along with continued monitoring of sanitary conditions. Contemporaneous coverage put it plainly: the company had pledged to systematically test its products and its water supply. I wrote about it that week.

Now read the sentence the company is publishing this month. Its July 24 statement says that according to FDA there are “no confirmed positive sample results for product testing.” Read it twice, for what it does not say. In 2013 the claim was product and water. In 2026 the claim is product. The water has quietly dropped out of the sentence.

I went looking for the results — thirteen years of them, from a program a company announced, a regulator reviewed, and a plant reopened on. I could not find one. Not a summary, not a count, not a season, not an audit that names the program, not a follow-up inspection report, not a line in any FDA update after August 2013. Nothing from the company, nothing from FDA, nothing from COFEPRIS, nothing from a third party. FDA’s own Cyclospora sampling in those years went to cilantro, basil and parsley, not to Mexican iceberg. That absence raises questions someone with subpoena power will be asking. Did the program run in 2014? In 2019? This spring? Which water, how often, by which method, and who ever saw the results?

The 2013 assessment already shows what a water testing record can look like in practice. FDA’s environmental assessment identified three ranches of interest. One entered the assessment only because the team reviewing the firm’s own irrigation water testing records found a positive fecal coliform result off drip irrigation tape. It had triggered no corrective action. The firm scored its water on a rolling mean of five samples — a mean at or below 126 MPN per 100 milliliters, no single sample at or above 235 — and one positive was not enough to move the mean or breach the ceiling. The record existed. The number was in it. The system was built so that nothing had to happen. It was also, start to finish, a bacterial system: FDA’s own guidance says fecal indicator testing will not identify Cyclospora cayetanensis, and that chlorine is not effective against it.

Anyone tempted to argue that water simply cannot be tested for this parasite should read what FDA did in Florida. During the 2020 bagged salad outbreak — 690 illnesses across thirteen states — the agency sampled regional water management canal C-23, west of Port St. Lucie, and detected Cyclospora cayetanensis with its own validated method. That canal had supplied irrigation water to a farm identified in the traceback. Genotyping could not tie the canal organism to the clinical cases, and FDA said so. It then told Florida growers to consider Cyclospora when assessing their own operations. It can be done. It has been done. Nobody has published having looked in Guanajuato — where, as I wrote last week, a public thermal-water bathing complex has stood eight hundred feet from the processing building since before FDA ever walked the property.

The same 2013 record carries a second unmet obligation. The assessment told the firm to determine whether Cyclospora is a reasonably likely hazard in that growing region and, if it is, to re-evaluate the wash step used on salad mix. No one has produced a document showing either was done.

A disclosure. My firm represents people sickened in this outbreak and has filed cases naming Taylor Farms entities as defendants. Everything above is on the public record either way.

There is now a committee of Congress in a position to settle this. On July 27 the ranking member of House Oversight, Rep. Robert Garcia, wrote to Bruce Taylor demanding documents on sanitary conditions, quality control and contamination at Taylor Farms de Mexico going back to January 1, 2013. Answers are due August 10. The letter went to the same executive who told reporters in 2013 that the plant was testing its water and that every test had come back clean. It would take one line to close the loop: produce the sampling program described to FDA in August 2013, and every product and water result generated under it since.

One piece of water testing at that plant does exist, and it is three weeks old. Between July 18 and 20, COFEPRIS inspected the facility, and Mexico’s national reference laboratory and the state public health laboratory reported its lettuce and its water free of Cyclospora cayetanensis and free of fecal coliforms. I include it because it is real and because the company will otherwise include it for me. I would also note when it was taken: after production had been suspended, and roughly two months after the median illness onset.

Which is the whole difficulty with a negative sample. If a clean result cannot exonerate, then thirteen years of clean results would not exonerate either. And if there are not thirteen years of them — if the water half of that program thinned out, or lapsed, or was never built the way it was described to FDA — then the sentence being published this month is doing work the record cannot support.

Michigan reported 9,253 illnesses on Monday, up 1,077 in three days. CDC’s outbreak count has not moved off 1,947 since Friday. Add up what the fifty states themselves report and the floor is past sixteen thousand people. A company said it was testing the water at Doctor Mora, a federal agency reopened a plant on that promise, and thirteen years later not one result from it has ever been made public. Somebody should ask to see them.

The federal count of the Cyclospora outbreak is 1,947 people in nine states, with 98 hospitalizations, no deaths, and illness onsets running from June 22 (what happened to May?) through July 20. Michigan by itself reported 9,253 cases on Monday, with 160 hospitalized as of July 23 and illness in 72 of the state’s 83 counties. Add up what the fifty states publish on their own pages and the national floor sits somewhere past 16,000. Three questions live inside that gap, and they are the questions that decide who gets counted as a victim of this lettuce and who does not.

First, what are the chances the nine-state outbreak is not Taco Bell or Taylor Farms at all as some have been spinning here at IAFP, and is instead a different restaurant or a different product? Second, what are the chances Taylor Farms is behind other Cyclospora illnesses in those same nine states that are not counted as Taco Bell cases? Third, what are the chances Taylor Farms is behind cases in the other states its product reached? Here are my answers and the numbers I used to get to them.

The first question is the easiest, and my answer is about one chance in ten — almost none of which is “a different restaurant.” Start with what the 1,947 actually is. FDA’s advisory says it plainly under the heading Stores Affected: cases with Taco Bell exposure have been reported from nine states. Taco Bell exposure is the case definition. The chance these people did not eat at Taco Bell is zero, and the chance that 1,947 people across nine states shared that exposure by coincidence is not worth writing down.

The real question inside the question is whether the ingredient is right. Michigan did the work that answers it. The state analyzed food exposure details from 190 of the Taco Bell cases and found that 90 percent of those interviewed had eaten iceberg lettuce. FDA’s traceback converged on a single supplier serving those locations. Taylor Farms then recalled all iceberg sourced from central Mexico and, as of July 18, suspended production of everything at the Doctor Mora plant. A company does not shut a plant over an ingredient it has ruled out.

Against that, there is no confirmed positive product sample, and the one that was announced was withdrawn. There is no published genetic match between the patients and the product. CDC noted early that not all Taco Bell locations in these states received shredded iceberg from the same supplier. I would put roughly eight to ten percent on a different Taco Bell produce item or a second supplier alongside Taylor Farms, and about two percent on something outside Taco Bell altogether.

One distinction has to stay separate. “Taylor Farms is the source” and “the recalled lots are the source” are different claims. The recalled foodservice product shipped June 29 through July 16. The earliest exposures in this outbreak precede that window. Taylor Farms can be the right answer while the recall is the wrong instrument.

The second question — whether Taylor Farms is behind the illnesses in those nine states that are not Taco Bell cases — gets a much higher number. I would say ninety percent that some of it is, and more likely than not that a large share of it is. The reason is structural rather than scientific. A man in Toledo who ate from a five-pound Sysco bag in a hospital cafeteria cannot enter the 1,947. A woman in Kansas who bought a Marketside bag at Walmart cannot enter it either. Neither of them ate at Taco Bell. They are excluded by the definition, not by the evidence.

Everything else points the same direction. The recalled foodservice product went into all nine outbreak states, and Sysco distributes those bags to hospitals, ballparks and restaurant chains. Michigan’s chief medical executive, Dr. Natasha Bagdasarian, has said her state’s investigation did not identify a single fast-food chain as the source, and that about twelve percent of patients have no clear link to lettuce or to a fast-food chain — which means roughly eighty-eight percent do, and most of those people are not Taco Bell cases. Michigan’s health department still says no specific produce type, grower or supplier has been identified as the source of its outbreak and that other foods cannot be ruled out. The nine states together report something on the order of 14,200 illnesses against a federal outbreak count of 1,947.

What I cannot do is put a defensible share on it. My range for the roughly 12,000 non-outbreak cases inside those nine states is that forty to seventy percent are the same product moving through channels other than Taco Bell, with the rest divided among ordinary background illness, travel-associated cases, and the testing surge that any well-publicized outbreak produces. Nobody will narrow that range without genotype comparison or lot-level traceback, and neither exists yet.

There is a plainer reason many of those cases are in nobody’s outbreak count. Ingham County has reported about 700 cases and has five nurses. It investigated about half of them and then decided to drop the older ones in order to keep up with the new. Michigan also reported 1,077 new cases on Monday, 475 of which were not previously reported because of delayed lab testing. Those people were not excluded from the outbreak because they failed a test. They were never asked the question.

The third question — whether Taylor Farms is behind cases in the other states its product reached — is where the arithmetic runs against the intuitive answer, and it is worth doing in public. Divide the country into three groups and compare rates instead of raw counts. The nine outbreak states hold about 67 million people and report roughly 14,200 illnesses, or about 21 cases per 100,000. The nineteen states that received recalled Taylor Farms product but are not in the outbreak hold about 155 million people and report roughly 1,400 illnesses, or about 0.9 per 100,000. The twenty-two states that received none of the product hold about 112 million people and report roughly 1,020 illnesses — also about 0.9 per 100,000.

Receiving the recalled lettuce, outside the nine, is associated with no measurable excess at all. Whatever this product did, it did more than twenty times as much of it inside the nine states, and beyond them it leaves no fingerprint that state-level numbers can see.

That is not the same as zero. Jack in the Box confirmed recalled lettuce reached its restaurants in Texas, Oklahoma and Louisiana. Marketside bags went to Walmart stores in fifteen states. Contaminated product shipped into nineteen more states did not make nobody sick. My estimate is tens to low hundreds of cases spread across all nineteen, identifiable one person at a time and only where somebody still has a bag, a receipt or a lot code. Call it eighty percent that some of those cases are out there and twenty-five percent that they amount to a large share of the 1,400.

Two honest counterweights belong with that. Those nineteen states never got the testing surge Michigan and Ohio got, so their counts sit closer to baseline and a real signal could be buried under ordinary underdiagnosis. And Alabama, Mississippi and South Carolina received recalled product and publish no case count at all, so part of my denominator is a guess.

What would settle any of this is not new science. CDC has run targeted sequencing on Cyclospora since 2018 for precisely this purpose, to tell apart clusters that look like one outbreak. Four questions follow, and the data to answer all four is already in federal hands.

Have the cases in the nine states who did not eat at Taco Bell been genotyped against the cases who did? That single comparison would resolve my second question, which is the one that covers the most people.

Has any case from the first half of the epidemic curve been walked back to a lot code? If a June illness traces to Doctor Mora product shipped before June 29, the recall never covered the front end of this outbreak.

Were the roughly 14,000 counted cases outside the outbreak definition ever screened against that curve, or were they set aside because no interviewer ever reached them?

And why did the case definition move? CDC’s first notice put the earliest onset at June 22. The July 17 update moved it to May 13. The July 24 update moved it back to June 22 and added four states. Forty days went out of the definition and came back, and no explanation has been attached to either move.

A lot-level traceability rule would have answered the lot-code question in twenty-four hours. It was supposed to be law on January 20 of this year. The first people in this outbreak got sick in the spring.

None of these questions are rhetorical. Every one of them can be answered with records the government already holds. Until somebody answers them, the number that gets printed — 1,947 — describes how many sick people ate at one restaurant chain. It does not describe how many people this lettuce did or did not make sick.