In twenty-four days, the same company has turned up at the center of two separate federal foodborne illness investigations. One is the largest Cyclospora outbreak this country has ever recorded. The other is a Salmonella Javiana outbreak that has sickened 345 people in 27 states. That does not happen to most produce companies in a decade. It has happened to Taylor Farms in a month, and the two are not the same kind of problem. I represent people sickened in these outbreaks and in several of the older ones below. That is a disclosure.

Start with the lettuce. FDA’s advisory, last updated August 5, counts 6,358 illnesses in fifteen states, at least 278 hospitalizations and two deaths in Michigan, with onsets from June 22 through July 31. CDC’s outbreak page carries the same figures. Those are laboratory-confirmed cases tied to Taco Bell or the recalled lettuce. My own fifty-state chart, built from what the states publish about themselves, stood at 27,937 cases across thirty-eight states last night. Maine became the sixteenth outbreak state on Friday, in a formal advisory from its own health department, and the federal count still says fifteen.

The recall behind it was announced July 17 by Taylor Farms de Mexico, out of the Doctor Mora plant in Guanajuato. FDA’s own enforcement file runs to twenty-one entries and 236,192 cases of lettuce, sold to nine customers including Subway, Sysco, US Foods and Walmart’s Marketside label.

Now the peppers, and here I am going to be fair before I am critical. Taylor Farms did not grow these jalapeños. A grower in Sinaloa did. Coast Citrus Distributors of San Diego imported them and sold them to wholesalers, restaurants and processors. FDA’s traceback converged on that grower, FDA recommended that Coast Citrus recall, and Taylor Fresh Foods recalled its own finished products on August 9 after its supplier notified it. On the jalapeños, Taylor Farms is a buyer handed a contaminated ingredient, the same as Chipotle and Kroger, and anyone reading a list of recalled salsa should understand that first.

What is worth writing about is the scale. Twenty products came off the shelf, into Hannaford, Kroger, Stop and Shop, Target, Trader Joe’s, Walmart and Whole Foods, and into distribution centers in twenty-six states. USDA issued a separate public health alert the day before for meat and poultry made with the same peppers, most of it out of Taylor Farms plants. One grower in Sinaloa, one importer in San Diego, and within a weekend the list reaches seven of the largest grocery banners in the country.

Count the products on that list with Taylor Farms on the package. There are five, all at Target. The other fifteen are Private Selection, Freshness Guaranteed, Trader Joe’s, or carry no brand at all. A shopper holding a tub of Kroger Spicy Pimento Cheese Dip has no way of knowing who made it. That is the private label business working as designed, and it is why telling people to check the refrigerator is not a plan.

And FDA still has not named the Sinaloa grower. It named Coast Citrus. Its advisory names Chipotle and QDOBA, and CDC’s investigation page counts twenty-seven illness clusters at those chains. The grower whose peppers are the reason for all of it stays confidential, while in the Cyclospora advisory FDA put Taco Bell in the first sentence and Taylor Farms de Mexico in the headline. I cannot find the principle that produces both results.

Anna Skinner at Newsweek published a timeline of Taylor Farms recalls and outbreaks on Monday that goes back seventeen years, and she deserves credit for how she did it. She built it partly off a review I put together, then did the harder half of the job. She called the company and printed its answer in full. She printed the entries Taylor Farms disputes and said so plainly.

Four days earlier CNN published an investigation of its own, by Casey Tolan, Yahya Abou-Ghazala, Curt Devine and Kyung Lah, arguing that this outbreak follows a years-long pattern of deflected blame. The key finding came from a former senior FDA food official, who told CNN that the 2024 McDonald’s onion investigation was a slam dunk and that Taylor Farms went to considerable lengths to keep the agency from naming it publicly. It did not work that time. Nobody had to make that argument about the 2024 romaine outbreak, because no agency named anyone at all.

CNN also put numbers on the oversight. FDA has not inspected the Guanajuato plant since 2019, and in the first half of this year five of the company’s more than 160,000 Mexican shipments were physically examined. Taylor Farms’ Mexican subsidiaries are the largest source of vegetable and salad shipments into this country of any manufacturer in the world.

In 2013 Bruce Taylor said the tests were negative and there was no evidence of Cyclospora in the product. In 2015, after a Montana laboratory found E. coli in the celery and onion mix behind the Costco outbreak, the one that put two children into kidney failure, he told the Monterey Herald it looked like a false alarm. In 2024 the company said its testing found no traces in the onions, in an outbreak that killed a man in Colorado. In 2026 it went to a false positive on a single border sample. Four outbreaks, one answer: the testing was clean. It is clean because people eat the evidence. A negative result on what is left in the cooler is not a finding of innocence.

The Newsweek timeline repeats that FDA apologized over the false positive. That apology is the company’s own characterization, from its July 19 statement. FDA’s record contains a laboratory correction and no apology; CNN reports the agency denied apologizing, and the company took its social media post down. In the same update FDA said it was continuing to work with the firm to remove product implicated in the outbreak. The word implicated survived the retraction.

Here is the company’s position, stated fairly. Taylor Farms says it invests more than $200 million a year in food safety, that it acted voluntarily and more broadly than asked on the lettuce, and that it put traceback protocols in place ahead of the Food Traceability Rule deadline. Take that last claim at face value and two questions have documented answers in its own files. How many days passed between the first Sinaloa pepper entering a Taylor Farms plant and the recall list being published, and how many between FDA’s first call about iceberg lettuce and the July 17 removal? A company with real time traceability can answer both in an afternoon.

What I want out of August is short. FDA should classify the July 17 lettuce recall, which three weeks on is still marked Not Yet Classified and has therefore never appeared in a weekly enforcement report. FDA should name the Sinaloa grower. Recall notices should carry customer names rather than brand codes, so buyers two steps down the chain know what is in their walk-in. And Taylor Farms should produce the water testing records and the adjacent land reviews for the Doctor Mora ranches, because its own website says both exist.

The fifty state health departments now report 27,937 cases of cyclosporiasis this season, up 1,182 from the 26,755 published on August 7. Ten states moved, and Maine appears on this chart for the first time. Indiana went to 1,893, Missouri to 1,577, Kansas to 615, Florida to 342, West Virginia to 291, Arkansas to 252, Wisconsin to 216, Virginia to 162 and Maine to 27, while Nebraska reached 218. Washington revised down by two. 

No federal number moved. FDA and CDC both still report 6,358 illnesses, 278 hospitalizations and two deaths in fifteen states, stamped August 5. CDC’s national surveillance page still reads 10,468 laboratory-confirmed plus more than 12,255 not confirmed, a total of 22,723, and has not changed since August 4. The states are now 5,214 cases ahead of that figure. CDC updates again Tuesday.

The thirteen states that publish a hospital figure now total 683 between them, after West Virginia moved from 20 to 21 and Wisconsin from 3 to 5. CDC’s national surveillance says 517 for the entire country. The federal figure for this outbreak is 278, and Michigan by itself reports 279. Thirty-seven states publish no hospital figure at all.

Where all fifty stand

The last column of this chart is new. It is that state’s entire 2025 total from CDC’s weekly notifiable-disease tables, which is a different series from the state figures beside it. It counts travel-associated cases and covers a full calendar year against a season still running. It is there for scale, not for arithmetic.

State2026 casesAs ofAll of 2025Lettuce
Michigan12,485Aug 650Yes
Ohio4,900Aug 476Yes
Indiana1,893Aug 1027Yes
Missouri1,577Aug 9none reportedYes
Illinois995Aug 4301Yes
North Carolina867Aug 4300Yes
New York753Jul 27694Yes
Kentucky620Jul 2945Yes
Kansas615Aug 529Yes
Oklahoma426Aug 441Yes
Florida342Aug 1210Yes
West Virginia291Aug 78Yes
Arkansas252Aug 1013Yes
Iowa226Jul 3064Yes
Nebraska218Aug 651No
Wisconsin216Aug 565Yes
Texas198Aug 5512Yes
Virginia162Jul 30115Yes
Colorado150Jul 17205No
Massachusetts145Aug 574Yes
Alabama85Aug 319Yes
Pennsylvania82Jul 29not notifiableYes
Maryland69Jul 17123Yes
New Hampshire69Aug 47Yes
New Jersey46Jul 11180Yes
California41Jul 14not availableNo
Minnesota41Jul 17none reportedNo
Washington36Aug 7not availableNo
Connecticut35Jul 1741Yes
Maine27Aug 74No
Oregon23Jul 24not availableNo
Arizona19Jul 1749No
Georgia11Jul 17116Yes
Tennessee11Jul 1738Yes
Alaska5Jul 166No
Rhode Island4Jul 176No
Louisiana1Jul 1799Yes
Utah1Jul 1737No
Delawareno count published1No
Hawaiino count publishednot availableNo
Idahono count publishednot notifiableNo
Mississippino count publishednot notifiableYes
Montanano count published8No
Nevadano count publishednot notifiableNo
New Mexicono count published9No
North Dakotano count published4No
South Carolinano count published45Yes
South Dakotano count published3No
Vermontno count published3No
Wyomingno count published0No
All fifty states27,937  50

What the 2025 column shows

Michigan reported 50 cases in all of last year and has reported 12,485 this year. Ohio reported 76 and is at 4,900, the sixty-four times figure its own health department has used. Indiana reported 27 and is at 1,893. West Virginia reported 8 and is at 291. Arkansas reported 13 and is at 252. Kentucky reported 45 and is at 620.

The same column shows which states are not unusual, and that has to be said. Texas reported 512 cases in 2025 and is at 198 this year. Colorado reported 205 and is at 150. Louisiana reported 99 and has published a single-digit count. Maryland and New Jersey are both running below last year. Not every state on this chart is having an outbreak, and the chart should not be read as though they are.

Four states do not make cyclosporiasis notifiable at all, so no figure exists to compare: Pennsylvania, Idaho, Mississippi and Nevada. Twelve states have published no 2026 count. Two of those, Mississippi and South Carolina, received the recalled lettuce.

What this figure is, and what it is not

27,937 is a floor, not an estimate. It is the sum of what fifty health departments have published, on schedules running from weekly to never, with four states reporting only a range that I count at the bottom. Where a state publishes two series, I use the one this chart has always used: for Florida that is the since-May-1 figure of 342 rather than the calendar-year 352, and for New York the since-May-1 figure of 753 rather than 787. Ohio and Iowa and Kansas and Arkansas are calendar-year, because that is the series those states publish.

Most people with cyclosporiasis never get a stool test, because the parasite is missed by the routine ova and parasite exam and has to be requested by name, and because people with a diarrheal illness that comes and goes for a month often never see a doctor. The standard estimate of that gap comes from Scallan and colleagues, Foodborne Illness Acquired in the United States, Major Pathogens, in Emerging Infectious Diseases in 2011, which puts the underdiagnosis multiplier for Cyclospora at 83.1. Applied to CDC’s 10,468 laboratory-confirmed cases, that puts the real number near 870,000.

Between July 14 and July 30, members of the House and the Senate wrote eleven separate letters about the Cyclospora outbreak. Five came out of the House and six out of the Senate. They went to the acting head of CDC, to the acting commissioner of FDA, to the Secretary of Health and Human Services, and twice to the chief executive of Taylor Farms. Four of them set a deadline that has now passed. Three more come due in the next four days. As of this morning I cannot find a published answer to a single one.

Start with the credit, because it is owed. A letter from a member of Congress is not a subpoena and it is not a rule, and I have spent thirty-three years watching letters like these go into a drawer. But a letter puts a specific question in writing with a name underneath it, and it creates a date on which somebody either answered or did not. Every one of these members chose to spend staff time and political attention on a parasite that most of the country had never heard of in May. Foodborne illness does not usually get eleven letters in seventeen days. This time it did, and the people who wrote them were right to.

The first came from Senator Amy Klobuchar of Minnesota on July 14. She wrote to the acting heads of CDC and FDA asking them to restore FoodNet, the Food Emergency Response Network, the Food Safety and Inspection Service, the Public Health Infrastructure Grants and the Preventive Health and Health Services Block Grant. Her sharpest observation is that there is no longer a central place to report and compare data across state lines, which is exactly the problem every count in this outbreak has run into since. She set no deadline.

Representative Greg Stanton of Arizona wrote to Secretary Kennedy on July 15 with six questions and asked for answers by August 3. Who directed the decision to cut FoodNet’s required surveillance, and what scientific or budget analysis supported it. What funding has been reduced or redirected since January 2025. How many surveillance staff have been terminated, reassigned or left vacant. What system now performs the active laboratory outreach FoodNet used to do. How many personnel are assigned to the federal response. And what evidence supports the department’s claim that none of these changes affected this investigation. That last one is the best question anybody has asked, and August 3 came and went.

Senator Jon Ossoff of Georgia wrote to Kennedy on July 16 with three questions and gave him seventy-two hours. Has FoodNet been restored to require tracking of Cyclospora cayetanensis, and if not, why was it terminated, and what is the status of the epidemiological and food safety investigations. He wrote that the demolition of these programs puts Americans at risk, and he was working off CDC’s confirmed count of 1,645 at the time.

Eight days later he had to write again, and that second letter is the reason I am writing this one. On July 24, having received nothing, Ossoff sent a second letter telling the Secretary that seventy-two hours had passed, that his questions had not been addressed, and that silence during an outbreak of diarrheal disease is its own kind of answer. By then he was citing more than 11,000 cases across forty-one states. A United States senator asked three plain questions, got nothing, and had to spend a second letter saying so. Nobody should have to do that twice.

The best letter of the eleven came from Michigan on July 17, and it is the best one because it was written from inside the outbreak. Representatives Debbie Dingell, Kristen McDonald Rivet, Hillary Scholten and Rashida Tlaib sent ten questions to CDC and FDA and asked for answers by July 24. Do you agree with Michigan that lettuce and salad greens are the source. What barriers are preventing you from acting on the leads Michigan has developed. How many federal personnel are assigned to this compared with outbreaks of similar size in the past five years. Those are the questions of people whose constituents are the ones in the hospital beds. July 24 passed without a reply.

Representative Josh Gottheimer of New Jersey wrote to CDC on July 20 asking that FoodNet be restored to full mandatory active surveillance, and paired the letter with two bills. The Foodborne Illness Rapid Response Act, written with Representative Don Bacon of Nebraska, would bar staffing cuts in the CDC divisions responsible for foodborne illness surveillance for a year after an outbreak is detected. The second would let state and local inspectors see the same unredacted inspection information federal regulators see, which matters because state and local inspectors do roughly sixty percent of the food processing inspections in this country. Neither bill has a number yet. Bacon is the only Republican name attached to anything in this file.

Senators Richard Blumenthal and Cory Booker asked CDC for a briefing that same week, wanting to know how the outbreak was tracked and whether federal staffing cuts caused the delay, with answers by the end of the following week. I have never been able to find a copy of that letter; it exists in the reporting and not in any archive I can reach, which is its own small problem when the point is accountability.

On July 27 the letters changed character. Representative Robert Garcia of California, ranking member of the House Oversight and Government Reform Committee, wrote to Taylor Farms chief executive Bruce Taylor — the first letter in this outbreak addressed to a company rather than to the government. He asked for five categories of documents by August 10: all communications with FDA, CDC and USDA since May 1; all communications with the White House since January 21, 2025; all internal communications about the outbreak; everything concerning the July 17 recall; and every inspection, audit, risk assessment and contamination record for Taylor Farms de Mexico going back to January 1, 2013. That last date is not an accident. It reaches back to the 2013 outbreak traced to the same Mexican growing region.

Three days later Blumenthal wrote twice more, and these two are different from everything before them. Writing as ranking member of the Senate Permanent Subcommittee on Investigations, he sent one letter to the acting FDA commissioner and a second to Bruce Taylor, both dated July 30, both due August 13, both copied to Chairman Ron Johnson. Both demand all communications with the White House, expressly including the Executive Office of the President and the Domestic Policy Council, and all communications between the agency and the company. The records definition names Signal and WhatsApp by name, which tells you the subcommittee has done this before. It matters that these came from that subcommittee: it is the Senate’s standing investigative body, it has subpoena capacity, and it is the same subcommittee that held a hearing on Cyclospora in imported raspberries in July 1998. Twenty-eight years, same subcommittee, same parasite.

The eleventh is the largest by signatures and the weakest by mechanism. On July 30, Representatives Marc Veasey of Texas, Debbie Dingell of Michigan and Terri Sewell of Alabama led about fifty colleagues in a letter to CDC and FDA asking for transparency and immediate action to identify the source. Veasey’s line is that public health decisions should be guided by science and transparency and not by outside influence, which is the same accusation Blumenthal makes with names attached. Fifty-three members signed it. It sets no deadline and demands no documents, and that is the difference between a pressure letter and an investigation.

Here is the whole set on one page.

Who wroteSentWritten toDeadlineStatus as of August 9
Sen. Amy KlobucharJul 14CDC and FDANone setNo answer found
Rep. Greg StantonJul 15HHS Secretary KennedyAug 3Passed, no answer found
Sen. Jon OssoffJul 16HHS Secretary Kennedy72 hours (Jul 19)Passed, no answer found
Reps. Dingell, McDonald Rivet, Scholten, TlaibJul 17CDC and FDAJul 24Passed, no answer found
Rep. Josh GottheimerJul 20CDCNone setNo answer found; two bills, no numbers yet
Sens. Blumenthal and BookerJul 20CDCEnd of that weekPassed, no answer found
Sen. Jon Ossoff (second letter)Jul 24HHS Secretary KennedyRestates the firstNo answer found
Rep. Robert Garcia, Oversight ranking memberJul 27Taylor Farms CEO Bruce TaylorAug 10Comes due Monday
Sen. Blumenthal, PSI ranking memberJul 30Acting FDA Commissioner DiamantasAug 13Comes due Thursday
Sen. Blumenthal, PSI ranking memberJul 30Taylor Farms CEO Bruce TaylorAug 13Comes due Thursday
Reps. Veasey, Dingell, Sewell and ~50 colleaguesJul 30CDC and FDANone setNo answer found

Two cautions about that table, and I would rather say them myself than have somebody find them for me. The first is that I believe it is every letter and I am not certain that it is. I built it from press releases, from the letter PDFs where offices posted them, and from news reporting where they did not, and a letter that went out quietly without a release is a letter I would not have seen. The second is the status column. It says no answer found, and that is exactly what it means and nothing more. An agency can respond to a member of Congress privately, and often does, and neither the agency nor the member has any obligation to publish it. What I can tell you is that I looked and found nothing published. If a member sent a letter that is not on this list, or if any of these eleven has been answered and I missed the answer, send it to me and I will correct this post and say plainly that I had it wrong. The list of answers is the part I would like to see grow.

There is something in that set that should worry every member who signed. Look at the numbers the letters themselves carry. Gottheimer’s announcement on July 20 described roughly 7,000 cases across thirty-four states. The fifty-three-member letter of July 30 described more than 4,000 cases and more than 300 hospitalizations. On July 29 the states were reporting 21,452. A letter signed by fifty-three members of Congress described an outbreak about a fifth the size of the one the states were counting. That is not a criticism of the members. They used the published federal numbers, because those are the numbers a congressional office is supposed to be able to rely on. The counting failure I have been writing about all summer has now reached the legislature itself, and the people writing the oversight letters are working from a picture the system gave them.

All eleven letters were written by Democrats. Don Bacon cosponsors a bill and Senator Bill Cassidy raised the outbreak in a hearing he was chairing, and that is the entire Republican presence in this file after eight weeks. Foodborne illness has historically been the least partisan subject in Washington, and it is worth remembering how recently that was true. Rosa DeLauro wrote FDA and CDC in August 2013 asking whether it is acceptable to identify the source of a Cyclospora outbreak and then withhold it from the public — during the outbreak traced to this same Mexican facility — and she wrote FDA again in August 2018 on the Fresh Express outbreak to say the timeline did not instill confidence. Thirteen years and eight years ago, the same questions. Nobody answered those either.

Six of the eleven aim at FoodNet, and FoodNet is the wrong instrument. It measures trends across about sixteen percent of the population; the systems that actually detect an outbreak are NNDSS and PulseNet. Restoring FoodNet is worth doing and it would not have found this outbreak a day sooner. Garcia’s letter is the only one of the eleven to name the Food Traceability Rule, which is the rule that would let anyone follow a bag of lettuce from a field in Guanajuato to a restaurant in Michigan, and which Congress has now directed FDA not to enforce before July 2028. If a member wants one thing to ask for that would change the next outbreak, that is the thing.

That brings me to the ask. A deadline with nothing behind it is a suggestion, and four suggestions have now expired. The Permanent Subcommittee on Investigations has subpoena power and a Republican chairman who has been copied on both letters. The Oversight Committee’s majority can join Garcia’s request and make it the committee’s request instead of the ranking member’s. Appropriations season is open. Any member who signed one of these letters can put the same question to the acting commissioner in a hearing, on the record, where not answering is visible. What should not happen is that August 13 goes by the way August 3 went by, and the next letter starts with the words seventy-two hours have passed.

The season closes on August 31. Taylor Farms has suspended its central Mexico iceberg sourcing until then, which means the natural end of this outbreak is going to arrive before any of these questions are answered, and an outbreak that ends is an outbreak that stops making news. Two people are dead in Michigan. The states have counted 26,755 sick. The federal government counts 6,358 in fifteen states, which is the number that will end up in the history of this thing unless somebody makes the agencies explain the gap. Eleven letters is not nothing. Eleven letters and no answers is a lesson, and the people who wrote them are the only ones in a position to make sure it is not the lesson that sticks. Thank you for writing. Please do not let it end there. I am watching, and so are twenty-six thousand seven hundred and fifty-five other people, and not one of us chose to be part of this.

Sarah Despres and Susan Mayne got to this before I did, on LinkedIn, and they answered it better than I would have. Credit where it belongs. Both have been steady, sourced, unglamorous voices through this outbreak while a great many louder people have not.

Here is what they were answering. Calley Means — senior adviser at the Department of Health and Human Services, one of the administration’s leading voices on food, the man generally credited with brokering the Trump–Kennedy partnership — posted on X that whenever you read about the Cyclospora outbreak, you should know that junk food companies are paying millions of dollars to spur “this hysteria” to get you to eat less real food. There are Cyclosporaoutbreaks every year, he wrote. This is the first year there is a media frenzy. The post quotes an earlier one of his own saying those companies are funding a fake “food borne illness advocacy” group to feed quotes to reporters attacking the real food agenda. Attached to it is a sheet of corporate logos belonging to the Alliance to Stop Foodborne Illness. Eighty-five thousand views and climbing.

Despres put the shape of it plainly: a senior White House official asserting that concern over the largest Cyclosporaoutbreak ever recorded in this country — one that has killed two Americans — is hysteria manufactured by the very food companies the outbreak is financially wrecking. A weird conspiracy theory, she called it, and one that suggests a cavalier attitude toward legitimate food safety problems. She also notes that in an earlier post he described this outbreak as a couple of cases of diarrhea.

Mayne answered the specific slander, and she is the right person to do it. She ran FDA’s Center for Food Safety and Applied Nutrition from 2015 to 2023. Stop Foodborne Illness, she wrote, is a thoroughly legitimate nonprofit public health organization devoted to preventing illness and death from contaminated food. She has known the group for years, long before anyone had heard of this outbreak. And she described what is on the walls of their offices: photographs of the faces of children who died of foodborne illness, hung there as a standing reminder of why the work matters, because it could have been anyone’s child. STOP works with consumer advocates and with industry, she wrote, because food safety has to be a shared responsibility.

Noble organization, noble mission.

That was her closing line, and I would not improve on it. Despres added that she has worked with STOP’s chief executive, Sandra Eskin — until recently the Deputy Under Secretary for Food Safety at the United States Department of Agriculture — and that Eskin has the record to back the commitment. I have watched this organization for three decades. Nobody bought it. It was built by people who arrived the hard way, carrying photographs.

Now take the accusation seriously enough to check it, because it collapses on the evidence Means chose himself.

The Alliance is not the same thing as Stop Foodborne Illness, and he has run the two together. It is a program housed inside STOP, launched in 2018 with ten companies and now at twenty-five industry partners, organized around food safety culture. Member companies pay in. That is a fair thing to disclose and a fair thing to argue about — I have spent years being skeptical of industry-funded food safety work and I will keep being skeptical of it. But disclosure is not fabrication. Saying a group takes corporate money is a criticism. Saying it does not really exist is a fantasy.

And look at whose logos are actually on the sheet he posted as proof. In December of last year, the Alliance added five members: Amazon, Amerisan, the Meat Institute, Mérieux NutriSciences, and Yum! Brands. Yum! Brands is Taco Bell. Its logo sits in the middle of the image he tweeted. So, the theory is that the corporate parent of the restaurant chain at the dead center of this outbreak — the chain whose sales have taken the hit, whose franchisees are named defendants in lawsuits my firm has filed — is quietly financing the panic about itself. The National Restaurant Association is on that sheet too, which is to say the trade association whose entire job is defending restaurants from exactly this kind of story. Walmart is on it, and Walmart sold the recalled Marketside lettuce. These are not the beneficiaries of lettuce fear. These are its casualties. That is Despres’s point about the illogic, and it is fatal to the whole theory.

The line about every year is true and useless. There are Cyclospora cases every summer; I have been writing about them since the 1990s. The reason there is a frenzy this year is that the numbers are not last year’s numbers. CDC now counts 6,358 illnesses across fifteen states in the lettuce outbreak alone, with at least 278 hospitalizations and two deaths in Michigan, while the states themselves report more than twenty thousand confirmed and suspected cases nationally. It is the largest Cyclospora outbreak this country has ever recorded, by a wide margin. Using an accurate background fact to launder away a foreground one is an old trick. Yes, there are outbreaks every year. There has never been one like this. It is not a couple of cases of diarrhea.

There is a real concern buried under the conspiracy framing, and Mayne got there first and got there better. In an essay in STAT she wrote that consumers should not be faced with a trade-off between nutrition and food safety. That is the legitimate version of the point. People do flee produce after a leafy green outbreak. They go to the pizza and the Doritos and tell themselves an Oreo never gave anybody explosive diarrhea, and they end up differently sick on a longer timeline from something that will never make the news. Nobody wins that trade, and I have watched it happen after every one of these for thirty years. But Mayne names the cause, and the cause is not a cabal. She has been documenting it week after week — career staff shown the door, the advisory committee disbanded, the joint work with Mexican counterparts ended, FoodNet cut from eight pathogens to two with Cyclospora among the six dropped, the traceability rule pushed to 2028. Asked on CBS Sunday Morning whether an outbreak next year could be traced, she said it could not. Her verdict was that this is a national wake-up call.

Despres has been asking the accountability half of the question, and she has the background for it — fifteen years of congressional oversight work, then Pew, then four years as Counselor for Public Health and Science in the Secretary’s office at HHS. Back on July 18 she asked publicly whether the Secretary was pushing Taylor Farms to be more transparent, given that the company was not making its customer list public. Three weeks later that is still the live question, and it has only sharpened as CNN documented the company’s long history of deflecting after outbreaks. Note what the two women have in common. Neither is asking the public to distrust vegetables. Both are asking the government to do the work that would let people trust them.

One last thing, and it is the part that bothers me most. Asked about this outbreak by a reporter this same week, Means said, “I don’t have a comment on cyclospora,” and that he did not want to get into it. No comment for the reporter. Eighty-five thousand views for the conspiracy theory. Two people are dead in Michigan and hundreds have been hospitalized, and the response from a senior official in the department that runs both CDC and FDA is that their families are props in a marketing campaign paid for by Costco and Hershey.

Understand where this criticism is coming from, because it is not coming from outside the tent. I have spent years arguing that the American diet is making people sick, that ultra-processed food is a public health problem, and that whole food is better food. Marion Nestle, who has taken more incoming from this administration than almost anyone, has said flatly that she is not MAHA’s enemy and supports parts of its agenda. Mayne’s whole argument is that nutrition and food safety rise and fall together. The people pushing back hardest on Means this week are not the opponents of eating real food. They are the ones who would have to make it actually work — and who know that it cannot work while the surveillance system that keeps real food from killing people is being taken apart.

That is why this matters beyond one bad tweet. The administration needs serious people advising it on food. There is real work available here — restore Cyclospora to FoodNet, stop delaying traceability, publish one national number the public can rely on — and none of it is partisan. An adviser who spent this week on that instead of on a conspiracy theory about Costco and Hershey would have my support and my thanks. Calling the parents of dead children a front group is not serious work. It is not even in the neighborhood of serious work.

Despres ended her post by saying it appears the White House is not taking this outbreak seriously, but that she is glad FDA’s career staff and outside groups are. That is about where I land too. I am not asking Means to agree with me about FoodNet, or traceability, or who should pay for what. I am asking him to look at the logo sheet he posted. Taco Bell’s parent company is on it. And somewhere on a wall in Chicago there are photographs of children, hung by the people he just called fake.

Three weeks ago, Taylor Farms recalled iceberg lettuce from its plant in Doctor Mora, Guanajuato. The July 17 notice named no customers, published no volume, and identified the buyers only by eight two-letter codes. Everything it left out has been sitting in FDA’s recall enterprise database since the day the recall was announced, in a record called Event 99453. Twenty-one separate product entries. I first went through it by hand today, one entry at a time, and then found there is an export button that hands you all twenty-one at once. Here is what is in it.

The recall covers 236,192 cases. That figure appears nowhere — not on FDA’s website, not in the company’s announcement, not in any story I have read. FDA’s system does not total the entries. It lists them, each with its own case count, and there is no sum anywhere on the screen. Nobody had to decide to withhold the number. It does not exist until somebody sits down and adds it up.

Start with the names, because that is the part that should never have taken three weeks. The public got CV, JB, MARK, MKTSD, PK, SUB, SY and TF. The federal record spells them out: Cross Valley Farms, which is US Foods’ private label; Marketside, which is Walmart’s; Markon; Peak; Sysco; Jack in the Box; Yum; Taylor Farms itself; and Subway.

Subway is 8,075 cases of quarter-inch shredded lettuce across fourteen lot codes. It is the largest single restaurant chain in this recall — larger than Yum at 5,900 cases, larger than Jack in the Box at 5,130. Subway has said nothing about this outbreak in three weeks. Jack in the Box put its own name out on July 18 without being made to and told reporters which states had received the product. The chain that volunteered is the one everybody has heard about. The chain that stayed quiet is the one nobody has written about, and it is the bigger of the two. That is not a coincidence. 

The Yum (Taco Bell) entry is 5,900 cases of quarter-inch shredded iceberg, and it has four lot codes. Four. They come from two days of production, Wednesday July 8 and Saturday July 11. The use-by dates run fourteen days past production, the shortest spec in the recall, and the earliest of them is July 22 — the latest starting point in the entire file. Whatever went to Yum under this recall was cut no earlier than July 8.

CDC’s median illness onset in this outbreak is June 22, and Cyclospora takes about a week to make somebody sick after they eat it. The median patient was exposed in the middle of June, and the first patients well before that. The customer sitting closest to the exposure that defines this outbreak had the narrowest recall of anyone in the file: two days of lettuce, weeks after people were already in the hospital.

There is a reason for that, and it is arithmetic rather than epidemiology. Every recalled item carries a use-by date, and not one of the 236,192 cases has a use-by date earlier than July 19 — two days after the recall was announced. Lettuce cut before the end of June had already expired by July 17. It had been eaten. You cannot recall it. The front edge of this recall is not a finding about when contamination started. It is the recall date minus the shelf life.

Doctor Mora did not open its doors in late June 2026. It is the same plant at the center of a Cyclospora outbreak in 2013, which means it has been shipping into this country for at least thirteen years. I said on July 19 that this recall could not have reached the lettuce that made the first thousands of people sick. I did not know then that FDA’s own file would prove it.

The next thing in the file is that this was never only an iceberg recall. FDA annotates every entry with what is actually in the product. Iceberg alone accounts for 167,504 cases. The remaining 68,688 — twenty-nine percent — is something more: lettuce and romaine blends at fifty-fifty, seventy-thirty and eighty-twenty; garden salad mixes with carrots and red cabbage; and salads carrying all four. Romaine, carrots and red cabbage came out of Doctor Mora and went into this recall, and the FDA outbreak page, the CDC outbreak page and every news story I have read say iceberg.

The company’s answer deserves to be stated fairly and stated first. Taylor Farms says on its Cyclospora information hub that the recall is limited to iceberg grown and processed at its central Mexico facility, and that its retail branded salad kits and chopped kits are unaffected. Those blends and mixes are foodservice packs — four five-pound bags to a case, six five-pound bags to a case — so the retail sentence holds as written. What separates a recalled Taylor Farms garden salad mix from a retail salad kit is pack size and sales channel, not what is inside the bag.

The lot codes show something the product names do not. Take TFMX191A02, one production run on Friday, July 10. It appears in thirteen of the twenty-one entries in this recall. It went out as plain shredded iceberg, as a lettuce and romaine blend, as a carrot and red cabbage salad mix, and as a four-vegetable salad with separate baggies — to Cross Valley Farms, Markon, Peak, Sysco and Taylor Farms’ own label, carrying four different use-by dates depending on the buyer. It is not the only one. Nine separate lot codes in this recall span all four product types.

I want to be careful about what that does and does not prove. The code almost certainly tracks the iceberg, with the romaine and the carrots and the cabbage blended in from somewhere else, so this is not evidence that the romaine was contaminated. It is evidence that one run of iceberg from Doctor Mora ended up in four different kinds of bag under five different companies’ names — and that when people were told to check their refrigerators for iceberg lettuce, some of them were holding a garden salad.

Then the volume, which has not been public in any form until now. Marketside — Walmart — is 109,476 cases, nearly half the recall by itself and the only entry aimed at consumers rather than restaurants. Four items, roughly ninety lot codes, ten to twelve bags to a case. That is well over a million bags of lettuce sold to Walmart shoppers. Taylor Farms’ own label is 68,897 cases. Cross Valley Farms is 19,016. Sysco is 11,519, Subway 8,075, Markon 7,459, Yum 5,900, Jack in the Box 5,130 and Peak 720.

Markon deserves its own sentence for a different reason. It is not a restaurant. It is a foodservice purchasing cooperative whose member distributors resell to independent operators who never see the Markon name on anything. A recall notice that reaches Markon has not yet reached the kitchen holding the lettuce. It is two more steps away, and nothing in the public record tells you whether it ever arrived.

Two more things sit in the distribution field, and I cannot explain either one. FDA’s recall record lists twenty-seven states, and West Virginia is not among them — while FDA’s own outbreak page lists West Virginia as an outbreak state, one of the original five. Same agency, same recall, two answers.

And at the end of the field, one line: foreign distribution, Mexico. The recalled lettuce went into the Mexican domestic market as well as the American one. I cannot find a Mexican recall notice anywhere. That does not mean there is not one. It means I cannot find it, and so far as I can tell nobody has asked.

Three weeks in, all twenty-one entries still read “Not Yet Classified.” No recall number assigned. No classification date. Status: ongoing. That matters more than it sounds, because the weekly Enforcement Report — the place FDA tells the public and the trade to look for recalls — only publishes a recall once the agency has classified it by hazard.

There is one field I do not understand at all. Every row carries a report date of August 19, 2026 — eleven days from now — while the classification is still blank and the recall number is still empty. I do not know what that means.

What do we now need from the FDA? 

  • Classify the recall, so that it appears where the public and the trade are told to look.
  • Publish the customer names with the notice, not in a database you have to already know exists in order to search.
  • Reconcile the state lists. 
  • Say what happened to the product that stayed in Mexico.
  • Produce the import history for the Doctor Mora plant, because that record will show how much, if any, lettuce crossed the border in May and June — the lettuce that is not in this recall, and that the sick people likely already ate.

Every number above comes out of FDA’s own enforcement record for Event 99453, and every link is here so you can check my work. The national case counts and the outbreak reporting are worth reading alongside it.

Check my work:

https://www.marlerblog.com/files/2026/08/08-08-2026_enforce_rpt.pdf

I was awake at three o’clock this morning doing arithmetic I did not want to do.  I have been thinking about this for weeks and considering the numbers.

Three outbreaks have shaped thirty-three years of my life. In the winter of 1993, undercooked hamburger from Jack in the Box carried E. coli O157:H7 into 732 people across four states. One hundred seventy-one of them were hospitalized. One hundred seventy-eight were left with permanent injury, most of it kidney and brain damage. Four children died, the youngest seventeen months old. In 2008 and 2009, peanut paste from a plant in Blakely, Georgia carried Salmonella Typhimurium out of Peanut Corporation of America and into 714 people in forty-six states. More than half of them were children and a fifth were under the age of five. Nine died. In 2011, cantaloupe from Jensen Farms carried Listeria monocytogenes into 147 people in twenty-eight states. One hundred forty-three of those 147 were hospitalized, ninety-nine percent of everyone who got sick. Thirty-three died and one pregnant woman lost her baby. The median age was seventy-eight. I represented the families of all thirty-three of the dead.

Put those three outbreaks end to end and they sickened 1,593 Americans and filled forty-six graves. The Cyclospora outbreak running right now has sickened at least 26,755 people. That is nearly seventeen times the three defining outbreaks of my career combined, and it has killed two.

There is a way to say that sentence that insults twenty-six thousand people, and I do not mean it that way. Let me deal with that first, because it matters more to me than the arithmetic does.

Nobody who has had cyclosporiasis has ever described it to me as mild. It starts about a week after exposure, sometimes as early as two days and sometimes as late as two weeks. Then comes watery, explosive diarrhea six to ten times a day, cramping, bloating, gas, nausea, a complete loss of appetite, and a fatigue that outlasts all of it. People lose ten, fifteen, twenty pounds. The worst part is that it comes back. It remits and relapses for days and sometimes for more than a month. People go back to work feeling human and are flattened again the following week. The only reliable treatment is trimethoprim-sulfamethoxazole, so a sulfa allergy leaves a patient with very little. There is no protective immunity afterward, which means a person can get it again. Three decades of listening to people describe foodborne illness, and this one is genuinely awful.

Two people in Michigan have died. Both, according to the state health department, had significant underlying conditions that may have been affected by cyclosporiasis and dehydration, and both became ill before the July 17 recall. I am not going to say more about them than that. Two families are living with this, and the fact that a statistician would call the case fatality rate low is of no use to either of them.

What kept me awake was not the two. It was what the number would have been if the organism riding on that lettuce had been one of the other three. CDC publishes the tool for answering that. Its burden model records, for each pathogen, the share of laboratory-confirmed patients who are hospitalized and the share who die. Checked against this outbreak first, the Cyclospora rate predicts about 1,739 hospitalizations out of 26,755 reported cases, and the thirteen states that publish a figure have reported 680 on a count that is still climbing. Here is what the same 26,755 people would have produced under each of the four organisms.

OrganismHospitalizedRateDeathsMultiplier
Cyclospora1,7396.5%083.1
Salmonella, nontyphoidal7,27727.2%13429.3
E. coli O157:H712,36146.2%13426.1
Listeria monocytogenes25,15094.0%4,2542.1

The model says the Cyclospora row should show zero deaths. It shows two. On the one organism where CDC’s model can be checked against reality this summer, it understates.

I do not have to take the model on faith for the other three, because I watched all of them. Jack in the Box hospitalized 171 of 732 and killed four. Run those observed rates against 26,755 and you get roughly 6,250 people in hospital beds and 146 dead. CDC’s model, built from entirely different data thirty years later, says 134. My own cases and the federal model land in the same place. That convergence is the part I could not put down.

The Listeria row in that table is not a real number and saying why is the most important thing in this piece. Twenty-six thousand seven hundred fifty-five invasive listeriosis cases would be roughly twenty-one years of the entire American burden of that disease compressed into one summer. It cannot happen, because Listeriakills people long before a count climbs that high. The largest listeriosis outbreak in American history was 147 people, and it killed thirty-three of them. The deadliest was 142 people in Los Angeles in 1985, and it killed forty-eight, twenty of them unborn. Neither one reached a hundred and fifty. Hold that against 26,755 and two.

That contrast is not a curiosity. It is the whole argument, and it is sitting in the last column of the table.

The last column is the underdiagnosis multiplier, CDC’s estimate of how many people actually get sick for everyone who is diagnosed and counted. Listeria is 2.1 in the older model and 1.7 in the 2025 rebuildCyclospora is 83.1. Listeria is 1.7 because it nearly always puts a person in a hospital where somebody draws a blood culture. Cyclospora is 83.1 because it sends a person home for a month. The multiplier is a severity index wearing a disguise, and this summer’s enormous count is enormous precisely because the organism is survivable. A lethal one would have produced a far smaller number that was far more complete. The size of the count and the mildness of the disease are the same fact.

The table also does not show what happens to the survivors. Five to ten percent of E. coli O157:H7 patients develop hemolytic uremic syndrome, which at 26,755 cases is between 1,338 and 2,676 people, most of them children. About half of them need dialysis, three to five percent die, and ten to thirty percent of the survivorscarry long-term kidney damage.

Now hold the exposure constant instead of the case count, which is the honest way to run this. Same field in central Mexico, same untested irrigation water, same processing plant at Doctor Mora, same 1.1 million bags of lettuce into a national grocery chain, same twenty-seven-state distribution footprint in FDA’s own recall record, same recall with its window set by shelf life rather than by contamination, reaching back only to product made in the last days of June against a median illness onset of June 22. Nothing in that chain is Cyclospora-specific. The water was not tested for anything. There is no kill step on a bag of lettuce for any organism and washing defeats none of them. The traceability rule that would have shortened the traceback is delayed to July 2028 for all of them, by Congressional direction. The agricultural water rule names generic E. coli as its only numeric criterion. Every one of those failures sits in exactly the same place if what was living in that canal had been O157 instead. And O157 does not send people home for a month. It sends children to dialysis, and in some instances, early deaths.

I do not have to imagine that one either. In 2006, E. coli O157:H7 came out of river water on a California ranch where a grass-fed cattle operation sat less than a mile from the spinach field, and it went into bags of fresh spinach shipped across the country. Two hundred twenty-five people were counted in twenty-seven states. One hundred sixteen of them were hospitalized. Thirty-nine developed hemolytic uremic syndrome. Five died. I litigated that one too. That is the same commodity, the same absence of a kill step, and the same water nobody was testing, twenty years earlier and with a different organism in it.

Here is the bleakest thing I know about my own profession. Every reform I have watched this country make came after a body count. Four dead children in 1993 got us pathogen reduction, hazard analysis, and E. coliO157:H7 declared an adulterant in ground beef. Five dead from spinach and nine dead from peanut butter got us the Food Safety Modernization Act and, eventually, a company president sentenced to twenty-eight years. Thirty-three dead from cantaloupe, seven months after that law was signed, put two growers in federal criminal court. Nobody legislated because 732 people had bloody diarrhea or because 147 people were hospitalized. They legislated because of the graves.

That means the arithmetic cuts the wrong way this time. This outbreak has produced more sick Americans than the three defining outbreaks of my career put together, and it has produced two deaths, and two deaths is not enough to move anybody.

I should say plainly what this exercise is and is not. Pathogens cannot simply be swapped at a constant case count, because attack rates and who gets sick differ by organism, and this summer’s 26,755 exists partly because Cyclospora leaves a large population alive to be counted. The rates I applied are observed among laboratory-confirmed patients while the 26,755 includes probable cases, so the run is generous. None of that changes the direction, and the direction is the only thing I am claiming.

We did not manage this outbreak. We drew the mild card. Twenty-six thousand seven hundred fifty-five people, at least 680 hospital beds and two graves is what the failure of an entire food safety system looks like when the organism happens to be the gentlest one in the deck. The national case count is still climbing. The next contaminated field will be planted in a few months, and nobody gets to choose what bug is living in the water when it is.

Luck is not a food safety program.

Saturday, August 8, 2026

Last Saturday this column was called The Week Cyclospora Stopped Being a Health Story and Became an Accounting One. This week the accounting stopped being the argument. On Monday it was announced that two people died in Michigan. On Tuesday a newspaper announced a federal expansion the government had not. On Wednesday the government’s own count went from 1,947 people in nine states to 6,358 in fifteen, and not one of those additional 4,411 Americans got sick that day. What changed was a definition. 

Two people died, and the state said no additional information would be provided. Michigan announced on Monday that both individuals had significant underlying health conditions that may have been impacted by cyclosporiasis and dehydration, that both fell ill before the July 17 recall, and that nothing further would be released. These are the first deaths anywhere in this outbreak. May have been impacted by is contributory language, not a finding on cause of death, and I will not stretch it into one. But I wrote on Monday and will say it again: who the hell cares that they had significant underlying health conditions. Most people who die in a foodborne outbreak do. It kills the very young, the very old and the immune compromised — that is who it has always killed, and the phrase does not make either loss smaller. I have represented families of people who died after eating a salad, and their losses were every bit as significant as anyone else’s. Nor has anyone described how a Cyclospora death gets counted in the first place.

The Washington Post announced the expansion two days before the government did. Lena H. Sun and Rachel Roubein reported Tuesday afternoon that CDC was expanding this outbreak from nine states to fifteen, attributed to three individuals familiar with the investigation, and by 4:13 p.m. Eastern they had named all six additions — Arkansas, Iowa, Missouri, Nebraska, New Hampshire and North Carolina. Every federal page still said nine that afternoon. Sun and Roubein have been right every time; this is about what has happened to the announcement channel for a federal outbreak investigation, and it was the second time in twelve days.

Then the federal count tripled, and nobody new got sick. On Wednesday CDC and FDA both posted it: 6,358 illnesses, fifteen states, 278 hospitalizations, two deaths. The day before, the same outbreak was 1,947 people in nine states. The case definition widened — until Wednesday a person entered by reporting they ate at Taco Bell, and now they can enter by eating at Taco Bell or by eating recalled Taylor Farms lettuce anywhere at all. The change was not announced, not dated, and the earlier series was not republished, so no trend line through it means anything. It is the point I have been making since mid-July. The federal number was never measuring a parasite. It was measuring one restaurant chain.

Taylor Farms says the lettuce shipped June 29. FDA says people started getting sick June 22.The company told the Post the recalled shredded iceberg went out June 29 through July 16, and when the paper asked what had shipped before June 29, it declined to say. CDC puts incubation at two to fourteen days, so a June 22 onset means an exposure at least nine days before the recall window even opens. New Hampshire published its own exposure window, the beginning of June through July 20 — four weeks wider than the company’s at the front, with a street address on it. A recall is a boundary drawn on a calendar. Taylor Farms drew this one and will not say what is on the other side of the line.

And Taylor Farms’ own page now says two different things about where the lettuce went. The company put up a Cyclospora information hub this week: central Mexico sourcing suspended for the season, production there halted since July 18, outside experts commissioned, roughly two thousand of its own samples negative since May, and a concession it spent July arguing around — that epidemiological evidence is a legitimate tool in an outbreak investigation. Read it twice, though. Its recall notice lists twenty-seven states without West Virginia; its own FAQ answers the same question with twenty-eight, West Virginia included. FDA’s advisory has the identical split between two of its sections. West Virginia has been an outbreak state since July 14, Nebraska is on neither list, and nobody has explained how a state joins an outbreak traced to a product the shipping records say never arrived. One line there is worth the whole page: the company says its water sources are tested for indicator organisms. That is generic E. coli — the only numeric criterion in the federal agricultural water rule, and the organism FDA’s own guidance says will not find this parasite. They are doing what the rule asks. The rule asks for the wrong test. CNN spent the week on the pattern behind all of it. Casey Tolan, Yahya Abou-Ghazala, Curt Devine and Kyung Lah counted at least five Cyclospora and E. colioutbreaks tied to the company over the past decade, and Lah put it on television Friday. A former senior FDA official says the company worked hard to keep the agency from naming it in the 2024 McDonald’s onion outbreak. FDA has not inspected the Guanajuato plant since 2019, and this year five of the company’s more than 160,000 Mexican shipments were physically inspected. People eat the evidence. A negative result on what is left in the cooler is not a finding of innocence, and it is no substitute for a name.

Michigan alone now reports more people hospitalized than the entire fifteen-state outbreak.The state finished the week at 12,485 cases with 279 hospitalizations. The federal figure for all fifteen states is 278. The same afternoon it reported that 279, Michigan lifted its bagged-salad advisory. Natasha Bagdasarian, the state’s chief medical executive, said the worst is behind us on the data available today, and was careful to say she meant Michigan. The state is also going from daily to weekly reporting, so the number that has driven this count all summer will now arrive once a week.

Ohio has now reported sixty-four times what it reported in all of last year. The state dashboard passed 4,900 cases, with 3,399 confirmed between July 4 and August 4 alone. Ohio confirmed 76 in all of 2025. Arkansas is at 237 against seven last year, 144 of them in Benton County, against the 41 Arkansans CDC counts in the fifteen-state outbreak. Add every state’s own published number and the floor is 26,755 people, up 5,303 in a week. CDC’s surveillance page reads 10,468 laboratory-confirmed plus 12,255 awaiting confirmation, unmoved since Tuesday. Hold any of those against the 249 cases reported nationally by this point last year.

FDA opened a brand-new Cyclospora investigation the same day it announced the old one had reached 6,358. The agency’s outbreak table now carries seven Cyclospora files and one of them names a food. Reference 1398 was posted August 5 — ten people, no vehicle. Reference 1385 went from 10 to 25, which FDA explains by saying it now includes illnesses with similarities in reported exposures — the agency telling you it has found a common exposure pattern in a file whose food it will not name. Six open files, 178 people, no product.

And I put the argument where people could check it. Thursday night Food Safety News ran fifteen things FDA and CDC could do about this parasite, four of which require no rulemaking, no appropriation and no act of Congress. Friday I wrote about recall readiness, which nobody measures until the week they need it. And earlier a box of t-shirts arrived, every one reading Test Infant Formula for Botulism — a different outbreak, four hospitalized babies, the same problem underneath it.

On the blog it was a week of old arguments picking up new proof. Thursday I said what I think of the Secretary’s July 21 assurance that this was under control, and set 2011 beside 2026 — sixty-eight people sick in ten states and CDC called it Restaurant Chain A, against FDA naming Taco Bell in the first sentence of its first advisory this July. Nothing changed in between but the decision to type the name. Friday I gave six reasons the produce trade association is wrong to tell CDC that endemic American water is behind this, the first being that the parasite does not multiply outside a person, so every oocyst in an American lake came out of an American. Marion Nestle told her readers what to do about all of it. And I sat down with KBJR in Duluth on the question I get asked most: when does food poisoning become a lawsuit. It becomes one when nobody will tell a sick family what happened to them.

The jalapeño outbreak got a country, a state and a distributor, but not a grower. CDC posted its Salmonella Javiana outbreak page Wednesday: 345 sick in 27 states, 36 hospitalized, with 177 of 191 interviewed reporting a Mexican-style restaurant and both Chipotle and QDOBA named. The peppers came from Sinaloa by way of Coast Citrus Distributors. The grower was identified by traceback and not named, and the recall carries no lot codes and no consignee list while CDC tells businesses to check whether their peppers are recalled. Javiana is a water organism. Two of the isolates carry antibiotic resistance, one of them multidrug-resistant and nonsusceptible to ciprofloxacin. And look at the sequence. Chipotle switched jalapeño suppliers on July 20 and QDOBA stopped serving them on July 28. FDA opened its traceback on July 22 and named Sinaloa and Coast Citrus on August 5. Two restaurant chains and a Minnesota epidemiologist got there first, and while they did, FDA’s own outbreak table still carried this file at 212 illnesses with no food identified. Three numbers for one outbreak, from one government, in one week. That is the sentence I have been writing about Cyclospora all summer, in a different aisle of the same store.

The recognized record of fresh-pepper Salmonella outbreaks in this country is exactly three, and all three came out of the same place. I put the whole history down this week. In 2008 SalmonellaSaintpaul sickened 1,442 people across 43 states, hospitalized at least 286, and investigators spent the summer wrecking the domestic tomato market before the strain finally turned up on a Mexican-grown jalapeño in a McAllen warehouse and in irrigation water on a farm in Mexico. In 2016 Salmonella Anatum sickened 32 people in nine states, and that one was solved only because FDA’s own laboratory happened to have sequenced an Anaheim pepper months before the outbreak existed. Now 2026. Three outbreaks in eighteen years is not a measure of how often peppers make people sick. It is a measure of how often anybody manages to prove it. After 2008 the Associated Press went through the border records and found chilies were the most-rejected Mexican crop of the preceding year, with Salmonella in eight percent of intercepted shipments. Nobody acted on it. Fresh chilies are grown outdoors in warm climates, irrigated with surface water, harvested by hand and eaten raw, and there is no wash that reliably clears the crevice where the stem meets the fruit. It is the same argument as the lettuce, and it has the same answer at the bottom of it, which is the water.

And the rest of the ledger, because it did not stop for the parasite. FDA’s outbreak table still carries the Midwest Poultry Services shell egg Salmonella Enteritidis outbreak at 98 illnesses and 26 hospitalizations across seventeen states, off a recall of more than nineteen million eggs. A Salmonella Oranienburg cluster sits at 93 with no food named at all. Still open too: the Listeria outbreak in Clover Hill requesón and soft ricotta, twelve sick, ten hospitalized, one dead; the E. coli O145:H28 investigation into GreenWise frozen blueberries sold at Publix; and the infant botulism outbreak behind the Nara Organics formula recall, four babies, all four hospitalized. On Friday USDA pulled 29,628 pounds of Argentine beef and 5,084 pounds of swai from the United Arab Emirates, both of which entered this country without import reinspection. Phyllis Entis has the international roundup at eFoodAlert, as she does every day.

That’s the week — two people dead, a federal count that tripled on a definition instead of an exposure, one state reporting more hospitalizations than the whole outbreak it belongs to, a company that will not say what shipped before the twenty-ninth of June, and a parasite that has made more Americans sick in one summer than the government’s own records show for the previous thirty-four years. And in the same seven days, jalapeños out of Sinaloa put thirty-six people in the hospital across twenty-seven states while the grower stayed anonymous. The season CDC defines runs through August 31. That is twenty-three days. Check back next Saturday.

About Bill Marler

William “Bill” Marler has spent more than thirty years as a food safety lawyer and advocate—work that began with the 1993 Jack in the Box E. coli outbreak and has never really stopped since. In the years that followed, he has represented victims in nearly every major foodborne illness outbreak in the United States. That case, and the movement it launched, is the subject of the book “Poisoned” and the Emmy Award–winning Netflix documentary of the same name. Bill’s work has been profiled in The New Yorker (“A Bug in the System”), the Seattle Times (“30 years after the deadly E. coli outbreak, a Seattle attorney still fights for food safety”), the Washington Post (“He helped make burgers safer. Now he’s fighting food poisoning again”), and many others.

Dozens of times a year, Bill speaks to industry, regulators, and universities across the United States, Canada, Europe, Africa, China, and Australia about a simple idea: outbreaks are preventable. He has testified before Congress on the Food Safety Modernization Act and teaches food safety at institutions including the Harvard T.H. Chan School of Public Health. He writes regularly about food litigation and food safety at Marler Blog, and in 2009 he founded Food Safety News, which he continues to publish.

CDC and FDA have named the vehicle, the growing region and the importer in the Salmonella Javiana outbreak: fresh jalapeños grown in Sinaloa, Mexico, brought into this country by Coast Citrus Distributors. Three hundred forty-five people in twenty-seven states, thirty-six hospitalized, no deaths, onsets running June 19 to July 20.

Start with the organism, because the organism is the tell. Javiana is not a livestock organism. It is one of the five most commonly reported Salmonella serotypes in the United States and simultaneously one of the most geographically restricted — concentrated in the Southeast, the Gulf and the Atlantic coastal plain in a pattern researchers have spent two decades attributing to an environmental reservoir rather than a food animal one. The leading candidate is amphibians and reptiles, whose abundance and diversity peak in exactly that warm, wet range. 

Which raises a question neither agency has asked out loud. What is a surface-water organism from the American Southeast doing on a farm in Sinaloa? Jalapeños do not grow in the dirt. They grow on a staked plant, in the sun, above the ground. Something wet put the bacteria on them.

I have spent the past month making an identical argument about Cyclospora and Guanajuato. Different organism, different Mexican state, same finding: the contamination is in the water, and the water sits upstream of every control anyone has bothered to install.

Which brings up the rule, and here the record is worse than I expected when I started looking. If irrigation water is where produce outbreaks are born — and it is, over and over, for twenty years — then the most important provision in American produce law is the one governing the water a grower puts on a crop before harvest. The 2015 Produce Safety Rule had one. It set a numeric microbial quality criterion for pre-harvest agricultural water — a geometric mean of no more than 126 colony-forming units of generic E. coli per 100 mL, with a statistical threshold value of 410 — and required growers to test against it. No farm has ever had to meet it.

Follow the dates. The original compliance deadlines were pushed back by a final rule on March 18, 2019 to January 26, 2022 for the largest farms, 2023 for small businesses, and 2024 for very small ones, so FDA could reconsider “the practical implementation of compliance.” Before the first of those dates arrived, the agency announced in its December 2021 proposed rule that it intended to exercise enforcement discretion for the pre-harvest, harvest and post-harvest water requirements while it rewrote them. January 26, 2022 came and went with FDA having already said it would not act on it. In July 2022 it proposed extending the pre-harvest dates again. On May 6, 2024, it finished the job: the numeric criterion and the testing requirement for pre-harvest water are gone, replaced by a systems-based annual “agricultural water assessment” in which the grower evaluates his own water system, identifies his own hazards, and decides for himself what mitigation, if any, is warranted. The assessments phased in on April 7, 2025 for large farms, April 6, 2026 for small ones, and April 5, 2027 for very small ones. FDA issued inspection instructions to its staff and the states in August 2025.

Nine years, three delays and a repeal. The one number American law ever attached to the water that grows our food went into the Federal Register and came back out without a single farm having to hit it.

To be fair to the new rule, it is not empty. When a grower’s assessment finds that adjacent land use is reasonably likely to introduce hazards from animal activity, from biological soil amendments of animal origin, or from untreated or improperly treated human waste, mitigation is required on an expedited timeline — no later than the same growing season. That is a real requirement aimed at exactly the right hazard. But all of it hangs on a grower looking at his own water once a year and writing down an honest conclusion. There is no number he has to hit. There is no sample he has to pull.

There is still a number in the rule, and it is worth knowing where it sits. Water used during and after harvest must have no detectable generic E. coli per 100 mL, and untreated surface water cannot be used for those purposes at all. FDA’s enforcement discretion on that ended January 26, 2023 for the largest farms. The single enforceable numeric water standard in American produce law applies to the wash line — after the crop has already spent its entire life drinking whatever was in the canal.

Then ask who checks. The Produce Safety Rule reaches foreign farms growing for American tables but reaching them requires getting someone to the farm. GAO reported in January 2025 that FDA averaged 917 foreign food inspections a year from fiscal 2018 through fiscal 2023, against a statutory target of 19,200, and that as of July 2024 the agency had 432 investigators total to cover both domestic and foreign work. ProPublica found last November that foreign inspections had fallen to a historic low after staffing cuts, with roughly twenty investigators dedicated solely to international assignments. The same reporting captured the model exactly: in 2023, FDA investigators did not reach a Mexican strawberry farm until about twenty people had been hospitalized with hepatitis A, and when they finally got there, they found handwashing water that was gray and leaking across the growing area and a toilet with no way to wash at all. We do not inspect these farms. We autopsy them.

That leaves verification to the importer, which is precisely what Congress intended. Under the Foreign Supplier Verification Program, an importer must identify the hazards in each food it brings in, evaluate the risk the food and the supplier present, approve the supplier on that basis, and conduct verification activities sufficient to establish that the foreign farm is producing food at the same level of public health protection U.S. law requires. For jalapeños from Sinaloa, the known hazard is Salmonella, and the known route is water. Whether Coast Citrus ever assessed that supplier’s water, and what it found if it did, is not public and will not become public unless somebody makes it so. I could find no FSVP warning letter to the company. What FSVP enforcement usually looks like is a letter, years after the fact, to a small importer in San Diego or Vernon or Pharr — firms told on a fourth inspection that they still are not in compliance, and firms that had no FSVP at all, for any food, years after the compliance dates passed.

Nobody died. The agencies will count that as a win. But no one was required to test that water before the harvest, no one was going to inspect that farm before the harvest, and no one will be paying for it after. The pepper was never the problem.

Ohio Alone Has Now Reported Sixty-Four Times What It Reported in All of 2025. The Fifty-State Cyclospora Count Is 26,755, and the Federal Number Has Not Moved Since Wednesday.

The fifty state health departments now report 26,755 cases of cyclosporiasis this season, up 919 from 25,836. Two states moved and both are inside the federal outbreak. Ohio went from 4,013 to more than 4,900, and Arkansas from 205 to 237.

The Ohio figure deserves a moment. The state health department’s dashboard shows more than 4,900 cases confirmed since the beginning of the year, of which 3,399 were confirmed between July 4 and August 4 alone. In all of 2025, Ohio confirmed 76. That is not a bad year. That is sixty-four times a normal year, in a single state, in about five weeks. Ohio’s hospitalizations have also moved, from the 96 the state reported in mid-July to 172 now, and the department says more than a hundred people have been hospitalized there in the past month.

One caution for anyone reading Ohio coverage this week. The state is running two figures at once: a press-conference number of nearly 4,000 counted since June 1, and a dashboard number above 4,900 counted since January 1. They are not in conflict and they are not interchangeable. This chart has always used the calendar-year dashboard series for Ohio, so 4,900 is the like-for-like figure, and I count it at 4,900 rather than at more than 4,900, the same way I count every range on this chart at the bottom of its range.

Arkansas reported 237 laboratory-confirmed cases on Friday. CDC says 41 of them are tied to Taco Bell or the recalled Taylor Farms de Mexico lettuce, which is exactly the federal figure for Arkansas in the table below — a rare instance this summer of a state number and a federal number describing the same thing and agreeing.

The federal count has not moved since Wednesday evening. FDA and CDC both still say 6,358 illnesses, 278 hospitalizations and two deaths in fifteen states. Against the 24,539 those same fifteen states report to their own residents, that is 25.9 percent. Against the fifty-state figure it is 23.8 percent. CDC’s national surveillance page still reads 10,468 laboratory-confirmed plus more than 12,255 not confirmed, which totals 22,723 and has not changed since Tuesday. The states are now 4,032 cases ahead of that figure, a gap of nearly eighteen percent, and CDC does not update again until Tuesday.

The hospitalization picture moved with Ohio. The thirteen states that publish a hospital figure now total 680 between them. CDC’s national surveillance says 517 for the entire country. The federal figure for this outbreak is 278, and Michigan by itself reports 279. Four numbers, one disease, one week — and thirty-seven states that publish no hospital figure at all.

Here is the federal count for each of the fifteen outbreak states against what that same department tells its own residents.

StateFederal outbreak countWhat the state reportsFederal share
Michigan3,49112,48528%
Ohio6454,90013%
Missouri5681,09552%
Indiana3701,70522%
Kentucky26562043%
Oklahoma18342643%
Kansas16546136%
Illinois16499516%
Pennsylvania13282more than the state reports
West Virginia12628045%
Nebraska9291more than the state reports
Iowa8322637%
Arkansas4123717%
New Hampshire316945%
North Carolina28670%
All fifteen6,35824,53926%

And here is where all fifty stand, with the source for every number.

State2026 cases reportedRecalled lettuceWhere the number comes from
Alabama85 (Aug 3); 78 lab-confirmed; 2 hosp.; 22 tied to two Mexican-style restaurant chains, which ADPH says are not Taco Bell; 8 travelYesADPH via WAFF
Alaska5 (Jul 16)NoAlaska DOH advisory
Arizona19 (Jul 17)NoAZ DHS, via roundup
Arkansas237 lab-confirmed in 2026 (Aug 7), up 32; 41 tied to Taco Bell or recalled lettuce per CDC; ADH reports Mondays and FridaysYesArkansas DOH via KNWA
California41 provisional (Jul 14)NoCDPH NR26-024
Colorado150 (Jul 17); 4 hosp.NoCDPHE, via roundup
Connecticut35YesCT DPH press release
DelawareNo count publishedNoCDC surveillance
Florida254 since May 1 (Jul 25); 264 calendar yearYesFDOH via News4Jax
Georgia11-30 since May 1 (Jul 17); counted here at 11YesGA DPH, via roundup
HawaiiNo count publishedNoCDC surveillance
IdahoNo count publishedNoCDC surveillance
Illinois995 (Aug 4); 58 hosp.; 631 domestic, 193 travelYesIDPH via CBS Chicago
Indiana1,705 (Aug 4); IDOH posts each weekday; Allen County 290, Marion 108YesIDOH via WANE
Iowa226 in 48 counties (Jul 30), calendar year; 47 travel-relatedYesIowa HHS weekly report
Kansas461 (Jul 29); 20 hosp.YesKDHE
Kentucky620 reported (Jul 29), 274 lab-confirmed; 24 hosp.YesKDPH via WSMV
Louisiana1-10 (Jul 17); counted here at 1YesLA DOH, via roundup
MaineNo count publishedNoCDC surveillance
Maryland69 (Jul 17)YesMD DOH, via roundup
Massachusetts145 (Aug 5); 9 in May, 32 in June, 104 in JulyYesMass. DPH via CBS Boston
Michigan12,485 (Aug 6); 279 hosp.; 2 deaths; MDHHS lifted its bagged-salad advisory Aug 6 and now reports weekly on ThursdaysYesMDHHS
Minnesota41 since May 1 (Jul 17)NoMDH, via roundup
MississippiNo count publishedYesFDA distribution list
Missouri1,095 (Aug 2); doubled in one week; 90 in Boone CountyYesDHSS via KCTV5
MontanaNo count publishedNoCDC surveillance
Nebraska91 since May (Jul 20); Douglas County alone 45 (Jul 28)NoDHHS via Nebraska Examiner
NevadaNo count publishedNoCDC surveillance
New Hampshire69 (Aug 4); 32 tied to recalled lettuce at Cheshire Medical Center, 0 hosp.; 32 unknown source, 3 hosp.; 5 travelYesNH DHHS
New Jersey46 (May 1-Jul 11)YesNJDOH news release
New MexicoNo count publishedNoCDC surveillance
New York753 since May 1 (Jul 27 data); 787 calendar yearYesNYSDOH
North Carolina867 since May (Aug 4); up 149 in a week; 33 hosp.; 494 in Wake CountyYesNCDHHS dashboard
North DakotaNo count publishedNoCDC surveillance
OhioMore than 4,900 calendar year (Aug 4), up from 4,013 on Jul 30; 3,399 confirmed Jul 4-Aug 4; 76 in all of 2025; 172 hosp.; counted here at 4,900YesODH via Spectrum News
Oklahoma426 (Aug 4); 418 confirmed, 8 probable; 25 hosp.YesOSDH via KOKH
Oregon23 in 2026 (Jul 24)NoOregon Health Authority
Pennsylvania82 (Jul 29); voluntary reporting, no state dashboard; PA DOH last published 28 (Jul 16)YesPA-HAN Advisory #833
Rhode Island4 since May 1 (Jul 17)NoRI DOH, via roundup
South CarolinaNo count publishedYesFDA distribution list
South DakotaNo count publishedNoCDC surveillance
Tennessee11-30 (Jul 17); counted here at 11YesTN DOH, via roundup
Texas198 (Aug 5); 37 hosp.YesDSHS via USA TODAY
Utah1-10 (Jul 17); counted here at 1NoUT DHHS, via roundup
VermontNo count publishedNoCDC surveillance
Virginia126 total (Jul 23); 66 domestic, 31 travel, 29 pendingYesVirginia DH
Washington38 (May 1-Jul 17)NoWashington DOH
West Virginia280 (Aug 4); 20 hosp.YesWV OEPS
Wisconsin160 (Jul 29); 3 hosp.; 50 domestically acquiredYesWisconsin DHS
WyomingNo count publishedNoCDC surveillance
Nine outbreak states21,9549 
The six added Aug 52,5856 
Received the recalled lettuce26,34229 
Did not receive it41321 
All fifty states26,75550 

One closing note on what this figure is. 26,755 is a floor, not an estimate. It is the sum of what fifty health departments have published, on schedules that range from daily to never, with four states reporting only a range that I count at the bottom. It is not an estimate of how many people are sick. CDC’s own burden model assumes roughly eighty-three actual illnesses for every laboratory-confirmed case of this parasite, which applied to CDC’s 10,468 confirmed cases puts the real number near 870,000. That multiplier does not go on 26,755, because the state totals already contain the unconfirmed cases the multiplier exists to estimate. What both numbers agree on is the direction, and the direction has not changed once all summer.

This started (Well, it actually started with getting up at 4:00 AM and too much coffee) with a farm radio script ninety-second item on the Land and Livestock Report saying a produce group wants federal investigators to look beyond food as the cause of the Cyclospora outbreak. Behind it was an August 4 press release from the International Fresh Produce Association. Behind that was a federal docket — 91 FR 32972, Docket No. CDC-2026-0925, CDC’s request to keep using the Cyclosporiasis National Hypothesis Generating Questionnaire for another three years that I dug for. I found the comments.

There are three. That is the entire outside response to the federal government’s proposal to keep using, unchanged, the instrument that generates every hypothesis about where Cyclospora outbreaks come from, filed in a summer when the states have counted 25,836 Americans sick.

Who filedWho they are
International Fresh Produce AssociationMax Teplitski, Ph.D., Chief Science Officer. Filed August 3, on letterhead.
Jonathan Angel, MDA physician who treats immunocompromised patients. Wrote in support of keeping the questionnaire.
Mitchell BergerA private citizen, writing expressly in his personal capacity. Filed August 1.

No state health department commented. Not Michigan, with 12,485 cases. Not Ohio, not Indiana, not Missouri. No consumer organization, no academic epidemiologist, no laboratory, no grower. The window ran sixty-two days, from June 2 through August 3, straight through the beginning of the largest outbreak of this disease in American history, and three people found it. I lately write about this parasite most days and I missed it too.

Now the part that matters. What IFPA filed is not what IFPA announced. The August 4th press release says the association asked CDC to consider a broader range of exposure pathways. Reasonable, technical, unremarkable. The comment letter behind it opens with a recommendation headed: consider the likelihood that Cyclospora has established endemically in the United States, and the likely routes of exposure for an endemic waterborne parasite.

That sentence is not in the press release. It is not in the association’s consumer FAQ. It went where regulators read things and not where reporters do.

Let me state the argument at its full strength, because it deserves that and because the weak version of my objection would lose to it. Cyclospora cayetanensis has no host but humans. It reaches the environment through water carrying human waste — agricultural runoff, aging sewers, combined sewer overflows. The oocyst leaves the body unable to infect anyone and needs warmth and moisture over days or weeks to mature, which is why this has historically been a tropical and subtropical disease. IFPA’s question is whether a warming United States now supplies those conditions often enough to sustain a domestic cycle. It notes that CDC’s own spring-to-summer season is also the season of heavy rain and sewer overflows. And it makes a genuinely sharp point I wish I had made first: because molecular typing cannot independently identify linked clusters — a limit CDC concedes in its own notice — the interview steers the entire investigation, so if water is never asked about, it can never be ruled in or out.

IFPA then drafted nine questions and attached them. Main drinking water source. Water drunk away from home, with zip codes. Awareness of flooding, sewer overflow or a boil-water advisory. Septic system and last service date. Occupational contact with sewage treatment, stormwater, portable toilets, biosolids. Camping on private water. And recreational water contact, with a checklist that runs pool, hot tub, splash pad, lake, river, pond, irrigation canal or ditch.

Strip off the letterhead and the argument is this: twenty-five thousand Americans did not get sick from Taylor Farms lettuce. They got sick from water in Michigan. That compression is mine and not theirs — IFPA never names a body of water, and its letter is careful to frame everything as a question for CDC’s consideration. But the outbreak is half in Michigan, the checklist says lake, and I do not think I am misreading who the questions are for.

Here is the tell, and it is not in what they asked for. It is in what they did not. Nine questions, and not one of them would improve produce traceback. No brand fields. No lot or date codes. No package type, no purchase location, nothing that would move an investigator faster from a sick person to a shipment. Mitchell Berger — a private citizen with nothing to sell, writing on his own time — asked for exactly that: replace the free-text brand and lot fields with structured ones so traceback data is analyzable. The trade association whose members would have to produce those codes did not.

If your stated goal is finding the source quickly and accurately, you want both halves. You ask for the water questions and the lot-code questions. Asking only for the half that points away from your sector is the answer to the question of what this filing is.

Two other things point the same way. This is the same argument IFPA made against Michigan on July 15, when it faulted the state for discounting recreational water — and then removed from its public statement four days later. It has now been refiled somewhere permanent and almost entirely unread. And the association addressed CDC’s Items 1, 3 and 4, but not Item 2, which asks whether the burden estimate is accurate. CDC told the Office of Management and Budget this collection needs 2,800 interviews a year. The states have counted 25,836 people. Nobody on the docket said a word about it.

Now let me be careful, because the sloppy version of this critique loses. The word endemic is doing three different jobs in that letter. That this parasite turns up in American wastewater is probably true and I am not going to pretend otherwise. That there is sustained domestic transmission is unproven. That endemic American water explains this outbreak is very unlikely.

Let me say why, because I have been asked and because a one-line dismissal is not an answer. Six reasons, and the first one is the one that does the most work.

This parasite does not multiply outside a person. It has no animal reservoir, and it does not reproduce in water or soil. Every oocyst in an American lake came out of an American. An endemic cycle therefore has to be primed: you need a standing population of infected people shedding into the water before anyone can catch it from the water. Last year at this point in the season CDC had recorded 249 cases nationally. All of 2025 produced somewhere over 2,800. That is not a reservoir. Endemicity has to start somewhere, and in April of this year there was nothing here to start it with.

Water is local. This outbreak is not. Fifteen states are in the federal count. New Hampshire does not share an aquifer, a lake, a river or a utility with Michigan. To explain fifteen states with domestic water you need fifteen separate local water events arriving inside the same eight weeks, for the first time in the recorded history of this disease. That is not one hypothesis. It is fifteen coincidences. What does reach fifteen states inside eight weeks, routinely and by design, is a distribution network.

New Hampshire is the cleanest example, and the state published it. Of its 69 cases, 32 are tied to recalled lettuce served at Cheshire Medical Center, 32 have no identified source, and 5 are travel-related. The largest identified cluster in the state is a group of people who ate Taylor Farms lettuce in the same building. They did not swim in the same building.

And then there is Minnesota. If recreational water were driving this, the map would follow lakes and hot weather. Minnesota, which puts the number on its license plates, reports 41 cases. Wisconsin reports 160. Florida, where people swim year-round, reports 254. California reports 41. Michigan reports 12,485. Michigan has lakes and so does Minnesota. What Michigan had that Minnesota did not was the product.

The line the cases fall on was drawn by a shipping manifest. Of the 25,836 cases the states report, 25,423 are in the twenty-nine states that received recalled Taylor Farms product. The twenty-one states that did not receive it hold 413 between them. That is ninety-eight percent of counted illness on one side of a distribution list. I have said before that a recall footprint is not a product footprint, and the recipient states skew large, so I would not hang a case on that number alone. But no water hypothesis predicts any correlation with a shipping list at all, and this one is not subtle.

Last, climate is a trend and this is a step change. American temperatures have been climbing for decades. Endemicity does not switch on in a single summer. 2025 produced more than 2,800 reported cases in the entire year. The states have counted 25,836 in the first week of August. Warming raises a baseline slowly; across seasons you can graph. A ninefold jump in one summer is not what a baseline does. It is what a contaminated shipment does.

None of that means water never matters, and none of it is an argument against adding IFPA’s questions. Add them. Add every one of the nine. The reason this is even a live dispute is exactly the reason IFPA gave: nobody asks, so nobody knows. What I am saying is narrower and I want to be held to it — endemic American water is a reasonable thing to investigate and a poor explanation for this outbreak, in these states, on this curve, in this year.

CDC has put in print that for every United States outbreak from the mid-1990s through 2015 in which both the vehicle and its source were identified, the produce had been imported — Guatemala, then Peru, then Mexico. Endemic domestic water does not produce that pattern for thirty years. It does not produce Michigan at 12,485 while Indiana sits at 1,705 and Ohio at 4,013; Michigan’s water is not unusual; Michigan’s distribution chain was. And the biology cuts the other way from how IFPA ran it: an oocyst needs one to two weeks in the environment before it can infect anyone, so a domestic cycle is inherently slow. That is a raised background, not a curve that climbs from a standing start in mid-May and is still climbing in August.

But their hypothesis is testable, and that is the whole point of this post. If these illnesses came from local water in dozens of watersheds, the parasites should be genetically diverse and should vary by region. If they came from one contaminated shipment, they should cluster. Those are different pictures and they do not look alike.

CDC can take that picture. It has been taking it since 2020. The single published study anybody cited on this docket is a CDC paper by Ahart and colleagues on the 2021 season, which built temporal-genetic clusters from sequenced stool isolates and then ran the epidemiology behind them — testing whether a genetics-first model would work for this parasite. Dr. Angel cited it for the proposition that the questionnaire separated one apparent outbreak into two. Having read it, the engine is the sequencer, not the questionnaire. I cited that same paper myself three weeks ago and did not notice it was the answer to the question I keep asking.

Which leaves IFPA and me wanting the same document for opposite reasons. They want the genotypes published because they expect diversity. I want them published because I expect a cluster.

One of us is wrong. The data that decides it was collected months ago, sits in Atlanta, and has not been published. CDC does not have to referee an argument between a plaintiffs’ lawyer and a trade association. It has to release a table.

And if the answer comes back diverse — if the sequencing says these are dozens of separate exposures and not one shipment — then IFPA is right, I am wrong, and I will say so in this space the same day. What I am not willing to do is let a hypothesis this consequential get settled by whoever files the better letter. It should be settled by the sequencer.

The questionnaire at the middle of all of this is a public document. Ten minutes will tell you which questions a sick person gets asked and which they do not. Three people read it this summer and wrote to the government. The season closes on August 31.