At six o’clock last night the fifty state health departments were reporting 23,295 cases of cyclosporiasis. This morning they are reporting 25,213. Ten states moved. Seven of them sit inside the fifteen-state outbreak the Washington Postreported yesterday afternoon, and three of them — Alabama, Massachusetts and Texas — do not.

No federal page says fifteen states. CDC’s outbreak page and its investigation update both still read nine states and 1,947. FDA’s advisory is still titled as an investigation of a nine-state outbreak and is still stamped July 24 with 98 hospitalizations and zero deaths. Twelve days. NBC News confirmed the six-state expansion Wednesday morning off its own source, so two national newsrooms have now reported it independently. The government has not.

Here is where the fifteen states in the outbreak stand this morning, and what the federal government says about the same fifteen. The nine were named by CDC. The six come from the Post.

State2026 cases reported by the stateAdded to the federal outbreak
The nine already on CDC’s outbreak page  
Illinois995July 24
Indiana1,349July 18
Kansas461July 24
Kentucky620July 14
Michigan12,218July 14
Ohio4,013July 14
Oklahoma426July 24
Pennsylvania82July 24
West Virginia280July 14
Those nine20,444 
The six reported as being added  
Arkansas205Reported Aug 4
Iowa226Reported Aug 4
Missouri1,095Reported Aug 4
Nebraska91Reported Aug 4
New Hampshire69Reported Aug 4
North Carolina867Reported Aug 4
Those six2,553 
All fifteen22,997Federal count for these states: 1,947

Where each state stands this morning, with the source for every number. Ten rows changed: Alabama, Arkansas, Illinois, Kentucky, Massachusetts, Michigan, New Hampshire, North Carolina, Texas and West Virginia.

State2026 cases reportedRecalled lettuceWhere the number comes from
Alabama85 (Aug 3); 78 lab-confirmed; 2 hosp.; 22 tied to two Mexican-style restaurant chains, which ADPH says are not Taco Bell; 8 travelYesADPH via WAFF
Alaska5 (Jul 16)NoAlaska DOH advisory
Arizona19 (Jul 17)NoAZ DHS, via roundup
Arkansas205 (Aug 5); 108 in Benton County (Aug 3); ADH reports Mondays and FridaysYesArkansas DOH
California41 provisional (Jul 14)NoCDPH NR26-024
Colorado150 (Jul 17); 4 hosp.NoCDPHE, via roundup
Connecticut35YesCT DPH press release
DelawareNo count publishedNoCDC surveillance
Florida254 since May 1 (Jul 25); 264 calendar yearYesFDOH via News4Jax
Georgia11-30 since May 1 (Jul 17)YesGA DPH, via roundup
HawaiiNo count publishedNoCDC surveillance
IdahoNo count publishedNoCDC surveillance
Illinois995 (Aug 4); 58 hosp.; 631 domestic, 193 travelYesIDPH via CBS Chicago
Indiana1,349 (Aug 3); Allen County 290, Marion 108YesIDOH via WRTV / WISH-TV
Iowa226 in 48 counties (Jul 30), calendar year; 47 travel-relatedYesIowa HHS weekly report
Kansas461 (Jul 29); 20 hosp.YesKDHE
Kentucky620 reported (Jul 29), 274 lab-confirmed; 24 hosp.YesKDPH via WSMV
Louisiana1-10 (Jul 17)YesLA DOH, via roundup
MaineNo count publishedNoCDC surveillance
Maryland69 (Jul 17)YesMD DOH, via roundup
Massachusetts145 (Aug 5); 9 in May, 32 in June, 104 in July; small clusters, some apparently linked to the recalled lettuceYesMass. DPH via CBS Boston
Michigan12,218 (Aug 5); up 710 in one day; 193 hosp. (Jul 30); 2 deathsYesMDHHS / Reuters
Minnesota41 since May 1 (Jul 17)NoMDH, via roundup
MississippiNo count publishedYesFDA distribution list
Missouri1,095 (Aug 2); doubled in one week; 90 in Boone CountyYesDHSS via KCTV5 / STLPR
MontanaNo count publishedNoCDC surveillance
Nebraska91 since May (Jul 20); Douglas County alone 45 (Jul 28)NoDHHS via Nebraska Examiner / WOWT
NevadaNo count publishedNoCDC surveillance
New Hampshire69 (Aug 4); 32 tied to recalled lettuce at Cheshire Medical Center, 0 hosp.; 32 unknown source, 3 hosp.; 5 travelYesNH DHHS / NHPR
New Jersey46 (May 1-Jul 11)YesNJDOH news release
New MexicoNo count publishedNoCDC surveillance
New York753 since May 1 (Jul 27 data); 787 calendar yearNoNYSDOH
North Carolina867 since May (Aug 4); up 149 in a week; 33 hosp.; 494 in Wake CountyYesNCDHHS dashboard
North DakotaNo count publishedNoCDC surveillance
Ohio4,013 in 80 counties (Jul 30); 96 hosp. (Jul 17); ODH puts Lucas Co. at 554, the county health dept. at 1,218 (Aug 3)YesODH via WOSU / Toledo Blade
Oklahoma426 (Aug 4); 418 confirmed, 8 probable; 25 hosp.YesOSDH via KOKH
Oregon23 in 2026 (Jul 24)NoOregon Health Authority
Pennsylvania82 (Jul 29); voluntary reporting, no state dashboard; PA DOH last published 28 (Jul 16)YesPA-HAN Advisory #833
Rhode Island4 since May 1 (Jul 17)NoRI DOH, via roundup
South CarolinaNo count publishedYesFDA distribution list
South DakotaNo count publishedNoCDC surveillance
Tennessee11-30 (Jul 17)YesTN DOH, via roundup
Texas198 (Aug 5); 37 hosp.YesDSHS via USA TODAY
Utah1-10 (Jul 17)NoUT DHHS, via roundup
VermontNo count publishedNoCDC surveillance
Virginia126 total (Jul 23); 66 domestic, 31 travel, 29 pendingYesVirginia DH
Washington38 (May 1-Jul 17)NoWashington DOH
West Virginia280 (Aug 4); 20 hosp.YesWV OEPS
Wisconsin160 (Jul 29); 3 hosp.; 50 domestically acquiredYesWisconsin DHS
WyomingNo count publishedNoCDC surveillance
Nine outbreak states20,4449 
Received the recalled lettuce24,04728 
Did not receive it1,16622 
All fifty states25,21350 

One more number, because 25,213 is a floor and not an estimate. In 2011 Elaine Scallan and seven colleagues at CDC published the agency’s foodborne burden model in Emerging Infectious Diseases, and its Table 2 still carries the only published United States burden estimate specific to Cyclospora. The underdiagnosis multiplier for this parasite is 83.1. For every laboratory-confirmed case, CDC’s own model assumes about eighty-three people actually got sick. Applied where it belongs, to the 10,468 laboratory-confirmed cases CDC reports this season, it puts the real number near 869,891. It does not go on 25,213. The state totals already include the cases the multiplier exists to estimate, so multiplying those counts the same people twice.

That is arithmetic rather than a measurement, and it should be read as a ceiling. The model’s own credible interval for Cyclospora runs from 137 to 37,673 domestically acquired foodborne illnesses a year, a 275-fold spread and the least precise line in the table. The 83.1 was built from data gathered before multiplex PCR panels carried a Cyclospora target at all, which happened in 2014, and an outbreak that has doctors ordering the test drives the true multiplier down further. Nobody has published an updated one; the 2025 revision of that paper covers seven pathogens and this parasite is not among them. What the figure is good for is the shape of the problem. The same table puts Listeria at 2.1, because severe illness gets diagnosed and a miserable, self-limiting one does not.

Ninety-eight people in seventeen states, twenty-six of them hospitalized, illness onsets running from November 21, 2025 to June 30, 2026 — that is the Midwest Poultry Services outbreak as CDC has it today, and FDA says the recalled eggs do not account for all of the illnesses. I wrote about it last week and made the point that the interval between a swab and a carton is where these outbreaks live. Then someone asked me how far back that goes. I went and looked. It goes back further than the rule does.

Start in February 2001, in four prisons run by the South Carolina Department of Corrections. Of 2,317 inmates, 688 reported to prison infirmaries with cramps, diarrhea and nausea. Stool specimens yielded SalmonellaEnteritidis phage types 2, 13a and 23. Two case-control studies pointed at a tuna salad served for lunch on March 2, made with eggs the inmate kitchen staff had hard-boiled — and boiling, as CDC noted in the same report, does not finish the job unless the yolk goes completely solid.

All four facilities bought eggs from one vendor. The eggs traced back to that vendor’s farm. And in February 2001 — the month before the March outbreaks — eggs submitted from that farm to the South Carolina Egg Quality Assurance Program had tested positive for Salmonella Enteritidis phage types 2, 13a, 22, 23 and 28. Phage type 2 was the strain that predominated in the sick inmates. The farm was a participant in the state’s own voluntary control program, the program found the organism, and the eggs went to the prisons anyway. In April the farm withdrew from the program. In April the prisons switched to pasteurized egg product. Six hundred eighty-eight people are what happened between February and April.

It did not stop at the fence line. That June, CDC’s outbreak detection algorithm flagged a rise in North Carolina, where the state lab counted 51 Salmonella Enteritidis cases in July and 31 in August against eleven in each of those months the year before. A case-control study tied the illness to eggs, and twenty-one of fifty-three patients carried the same PFGE pattern — the same pattern, and the same phage type 13a, found in the South Carolina prisoners. Two states, one probable farm. The traceback from retail was inconclusive. Nobody was ever named.

Understand what that decade looked like underneath the outbreaks. From 1990 through 2001, state and territorial health departments reported 677 Salmonella Enteritidis outbreaks: 23,366 illnesses, 1,988 hospitalizations, thirty-three deaths. Of the 309 outbreaks with a confirmed vehicle, 241 of them — seventy-eight percent — were shell eggs, accounting for 14,319 illnesses. Twenty-two of the thirty-three deaths happened in institutions, in nursing homes and prisons and assisted living, to people who do not get to choose what is on the tray. And those are only the counted ones. USDA and CDC modelers put shell-egg SalmonellaEnteritidis illness in the single year 2000 at 182,060, with an uncertainty range topping out near 276,500.

FDA’s Egg Safety Rule arrived in 2009. Here is the whole record since, every multistate Salmonella outbreak traced to American shell eggs, and I would ask you to read it for the dates as much as the numbers:

2010 — Wright County Egg and Hillandale Farms, Iowa. S. Enteritidis. CDC counted 3,578 illnesses between May 1 and November 30 against a baseline near 1,639, leaving roughly 1,939 attributable. Half a billion eggs recalled, still the largest shell egg recall in American history. Congressional investigators later put in the record that environmental sampling in and around the cages between 2008 and 2010 had produced 426 positive Salmonella results at Wright County, seventy-three of them potentially Enteritidis. All of it before anyone got sick.

2015 and 2016 — Good Earth Egg Company, Bonne Terre, Missouri. S. Oranienburg, the same strain both times. Fifty-two sick in six states, a cease-operations order, negative resamples, a reopening — and then eight more sick in three states with two hospitalized, the outbreak strain recovered from eggs at a Missouri restaurant and from the processing facility itself, after which Missouri closed the operation for good.

2018 — Rose Acre Farms, Hyde County, North Carolina. S. Braenderup. Forty-five sick in ten states, eleven hospitalized, 206,749,248 eggs recalled. FDA’s warning letter found the outbreak strain in the processing plant and in manure from laying house No. 9, and rodents throughout.

2018 — Gravel Ridge Farms, Cullman, Alabama. S. Enteritidis. Forty-four sick in eleven states, twelve hospitalized — a thirty-two percent hospitalization rate against a twenty percent norm.

2024 — Milo’s Poultry Farms, Bonduel, Wisconsin. S. Enteritidis. Ninety-three sick in twelve states, thirty-four hospitalized, onsets May 23 to September 13.

2025 — August Egg Company, Hilmar, California. S. Enteritidis. One hundred thirty-four sick in ten states, thirty-eight hospitalized, one death. Onsets February 24 to June 6. 1.7 million dozen recalled. When CDC put out its first alert the day after the recall, the count stood at seventy-nine in seven states. It nearly doubled after the eggs came off the shelf.

2025 — Country Eggs, LLC, Lucerne Valley, California. S. Enteritidis, nalidixic-acid resistant. One hundred five sick in fourteen states, nineteen hospitalized, onsets January 7 to August 14. Four restaurant sub-clusters. FDA inspected and three environmental samples came back positive.

2026 — Midwest Poultry Services. S. Enteritidis. Ninety-eight sick in seventeen states, twenty-six hospitalized, 1,589,577 dozen recalled on July 22 — nineteen million eggs — and the investigation still open.

Now notice the hole in the middle. Between Gravel Ridge in September 2018 and Milo’s in September 2024 there is not one CDC-posted multistate egg outbreak. Six years. I do not believe for a minute that American laying hens took six years off. Four of these landed in the last three years, and the last three each ran seven or eight months of onsets before a carton moved.

The named multistate outbreaks since the rule add up to something under 2,500 counted illnesses. The 1990s counted 14,319 from shell eggs alone, and the modelers said 182,060 in a single year. The disease did not shrink by that ratio. What shrank is how often we go looking, and how fast we act on what we find.

Because the finding has never been the problem. South Carolina’s farm was in the quality assurance program. Wright County had 426 positives in its own files. Rose Acre had the strain in laying house No. 9. Country Eggs had it in three environmental samples. Midwest Poultry says its own monitoring is what caught this one. In every case somebody had the answer written down. The farm knew in February. The prisons ate in March. Twenty-five years of this, and it is still that same interval, dressed up as bad luck.

Two days ago, I posted fifteen questions nobody had answered. Since then, a newspaper has put one of them to the company and been refused. Three have moved without anyone answering them. Eleven have not been touched. And eight new ones have popped into my sleepless brain. Here are all twenty-three, short.

The fifty state health departments now report 23,295 cases. The fifteen states the Washington Post reports are in the federal outbreak — Arkansas, Illinois, Indiana, Iowa, Kansas, Kentucky, Michigan, Missouri, Nebraska, New Hampshire, North Carolina, Ohio, Oklahoma, Pennsylvania and West Virginia — account for 21,393 of them. CDCs surveillance page carries 10,468 laboratory-confirmed cases plus more than 12,255 unconfirmed. FDAs advisory says 1,947 illnesses and 98 hospitalizations in nine states and has said so since July 24. Michigan reports two deaths. Twenty-six days remain in the Cyclospora season.

Asked, and refused

What shipped before June 29, and how many pounds were recalled? On Tuesday the Post put both halves of that question to Taylor Farms and the company declined to answer. It matters more than it did Sunday, because the company says the recalled lettuce shipped June 29 through July 16 while FDA says the illnesses began June 22. Cyclosporiasis takes about a week, and CDC puts the range at two to fourteen days. The first person in the federal governments own outbreak ate that lettuce nine to twenty-one days before the recall window opens.

Moved, but not answered

How many people have died, and how would anybody know? Michigan reported two and CDC acknowledged them. The number moved; the method did not. There is still no published death definition for this illness, no described matching against vital records, no follow-up on hospitalized patients. And the government now says three things at once: CDCs outbreak page says two, CDCs investigation page on the same website says none have been reported, and FDA says zero.

Where else did the recalled lettuce go? Consumer Reports went to the companies and confirmed three of the abbreviations on the recall notice: MKTSD is Walmarts Marketside, SY is Sysco, JB is Jack in the Box. Four others are still guesses, including mine. The House Oversight demand for the full list is due Monday. Three names out of eight, obtained by a magazine three weeks after a recall, is not disclosure.

Were the other twenty thousand ever screened against the case definition? Answered by events, not by anyone saying so. CDCs confirmed count jumped from 6,707 to 10,468 in one update and six states were added the same week. Somebody went back through cases previously outside the count. Nobody has said how, or how many were reviewed and set aside.

Eight questions that did not exist on Sunday

Why is a newspaper announcing federal outbreak expansions? Second time in twelve days. July 24had a CDC release behind it. Tuesday had four anonymous sources and no comment from CDC. As I write this, no federal page says fifteen.

What are the six new states being added on? Missouri says its investigators interviewed patients who reported eating at Taco Bell. Nebraskas Douglas County said the same in July, with nearly two thirds of interviewed cases naming the restaurant. New Hampshire has thirty-three cases and its only documented cluster is seventeen people at a hospital cafeteria in Keene. Arkansas, Iowa and North Carolina have published no basis at all.

Did the case definition change when they were added? CDCs own wording is 1,947 people infected and reporting exposure to Taco Bell. That is the entry ticket, and it is why a state with 11,508 cases contributes a fraction of them. If New Hampshire is coming in on those seventeen cafeteria cases, the definition has broadened for the first time. One sentence from Atlanta would settle it.

How did Nebraska get in? Nebraska is not on the companytwenty-seven-state distribution list. Neither is West Virginia, which has been in this outbreak from the start. The likeliest answer is not sinister: the recall notice records where Taylor Farms shipped directly, and the chains own distributors likely carried it the rest of the way. If so, that list is a shipping manifest and not a map of where this lettuce was eaten, and every consumer checking it has been reading the wrong document.

What is the hospitalization rate now that the case count has doubled? CDCs last figure is 423, attached to 6,707 confirmed cases. The confirmed count is 10,468 and Tuesdays update carried no new number. Thirteen states publish a figure of their own and those add to 433. Ohios ninety-six dates to July 17, when Ohio had 1,316 cases; Ohio now has 4,013. Nobody is updating the injury column while the case column triples.

Why did CDC take the state count off one page and leave it on another? On Tuesday evening the sentence on the surveillance page describing this outbreak stopped saying nine states. The investigation pagestill says nine. If the number came out because it is about to become fifteen, that should have come with a sentence saying so. Silent edits to a live outbreak page are how a public record becomes unreliable.

Did anyone in this government call the British? UKHSA reported sixty-seven cases in returning travelers against an annual average of ninety-three for whole years. Forty-eight of the fifty-one with travel information had been to Mexico, at different hotels in the same two regions — a supply chain, not a kitchen. Ontario has warned its residents about travel to Michigan. Neither CDC nor FDA has mentioned either country.

What happened to North Carolinas parsley? A week ago, the state said its increase did not appear associated with the Taco Bell outbreak and that patients were reporting parsley and cilantro more often than expected. Today it is in the lettuce outbreak. Both cannot be the whole story for 718 cases. FDAs own closed-investigation table carries reference 1325 from August 2025: parsley, sixty-nine cases, closed. Washington named parsley as a vehicle for this parasite twelve months ago.

Eleven that have not been touched

Why did the outbreaks start date move, and how many left the count? Onsets of May 13 to July 13 became June 22 to July 20 while the count rose by 303 and four states were added. A tightened case definition is a fair explanation and probably the right one. It is also unstated. Everyone who got sick before June 22 left this outbreak and nobody has said how many that was.

Do the two peaks in CDCs own epidemic curve carry the same genotype? A second hump normally suggests person-to-person spread, and this parasite cannot do that. A second wave therefore requires a second exposure event. CDC has run targeted amplicon deep sequencing on this organism since 2018 for exactly this purpose. Nothing has been published.

What is in the other five investigations? FDAoutbreak table carries six Cyclospora files. Five read Not Yet Identified: ninety-three cases, ten, eighteen, two and eight. That is 131 people where the government opened an investigation, ran a traceback and named nothing. Add the outbreak and every illness attached to a federal file this season comes to 2,078, against 23,295 the states report.

Did the 2013 sampling program ever run, and what did it find? The same plant reopened in 2013 on a stated condition: comprehensive sampling of product and water, plus continued monitoring of sanitary conditions. Thirteen years later the companys defense is that no product sample has ever tested positive. Whether it ran, and what it showed, has a paper answer somewhere.

Has anybody sampled the water? FDAs 2013 environmental assessment recommended this firm determine whether Cyclospora is a reasonably likely hazard in that growing region and, if so, re-evaluate the wash step. That is a standing obligation. What has changed since Sunday is that I can now say where the records are. Rainfall and river levels for 2026 sit in CONAGUA’s Sistema de Información Hidrológica. The long record sits in the national meteorological service’s climatological archive, more than 5,400 stations. Guanajuatos state water commission administers 419 climatological stations and 395 monitoring wells across sixteen aquifers. Drainage and wastewater-treatment records for the town beside that plant belong to the municipal utility of San José Iturbide. The question is no longer whether anyone sampled. It is why nobody has gone and looked, when every one of those filing cabinets has an address.

What is Mexico doing? In 2013 the investigation was run jointly with COFEPRIS, SENASICA and Guanajuato state health authorities. In 2026 there is no published Mexican case count, no Mexican agency statement, and no sign anyone on that side of the border is investigating. Every document in this outbreak is American. The contamination is not.

Were the harvest workers sick? The 2013 assessment tabulated prescriptions written for harvest crews and found the antibiotic combination used to treat cyclosporiasis being dispensed during the outbreak window. That proves nothing standing alone and I have said so. It is also the most direct question anyone could ask about a fecal-oral parasite, and in 2026 nobody has asked it.

What happens to patients who cannot take the only recommended drug? Two of the four clients whose cases we have filed are sulfa-reactive. Both were prescribed nitazoxanide; one could not obtain it, because it was on backorder, and her husband drove roughly seven hours to fill it. She was hospitalized. At 23,295 counted illnesses, several hundred Americans are in that position now, and no federal agency has said a word about second-line supply.

What does this illness actually leave behind? The produce industrys consumer FAQ says no significant long-term health consequences have been reported. I would like to know what study that rests on. Nobody is following this cohort, and the government values a case of this disease at four hundred sixty-five dollars — a number that survives only if nobody checks month three.

When did Taco Bell first hear from sick customers? Store signs went up in Michigan in early July saying the restaurants could not serve lettuce, cilantro, onions, pico de gallo or guacamole. On July 14 the company said no link had been confirmed to any ingredient or supplier. Both were true at once. Product does not come off a prep line for nothing, and the date the company first had enough to act exists in a ticketing system.

Why is any of this being answered in litigation instead of by a public agency? The 2024 romaine outbreak that killed one person and hospitalized thirty-six is known to involve this company only because we sued and posted the pages. This week the country learned its largest Cyclospora outbreak had grown by two thirds from a newspaper quoting people not permitted to say their names, and Food Safety News is publishing the fifteen-state count because the states publish it and the federal government does not.

Twenty-six days

Nine members of Congress have written about this outbreak. Not one has been publicly answered. The Oversight deadline falls Monday. CDCs confirmed count more than doubled this week and now sits 572 cases short of what the fifty states have been reporting all along, which means the states were right in July and confirmation had not caught up. The illness was always there.

The season closes August 31. In 2013 the same parasite from the same valley produced an investigation that ended without an answer and stayed that way. Twenty-six days from now the counts will flatten, the reporters will move on, and nineteen of these twenty-three questions will still be sitting there unless somebody makes them expensive to ignore. I have written down what I think ought to be done. Answering these comes first.

Good Morning. Overnight the pepper picture sharpened. FDA has now identified the strain behind both the Minnesota and the Colorado illnesses as Salmonella Javiana, which resolves the question I raised yesterdayabout whether Colorado’s 110 cases belonged to the same event. They do. Minnesota has named jalapeños as the suspected vehicle. Chipotle has pulled a common lot and posted a statement on its own websiteacknowledging a potential connection between the peppers it served and FDA’s ongoing investigation. Minnesota has said plainly that the contaminated product went to other restaurants too.

What still does not exist, thirteen days after FDA opened its traceback and with 212 people counted, is the name of a single supplier, a list of states, a case count that anyone can reconcile, a public epidemiologic curve, a CDC outbreak notice, or one word of advice to a consumer about what to avoid. I have spent thirty-three years watching this particular silence, and the only reliable way to shorten it is to ask specific questions in public and write down who refused to answer.  Here we go.

To FDA. Your outbreak table has carried this investigation as “product not yet identified” since July 23, and you told reporters you opened a traceback of multiple ingredients on July 22. Minnesota named jalapeños on August 4 and Chipotle identified a common lot. Are jalapeños the ingredient you are tracing, and if the answer is anything other than yes, what else is on the list? Who is the supplier, and on what date did you learn the lot code that Chipotle says its own system produced? Was this product grown domestically or imported, and if imported, is there an import alert, and have you sampled at the border? You have said you will provide additional information “if and when there is an actionable public health update” — with two states confirmed, a suspected vehicle named by a state health department, and a company pulling product nationally, what is the threshold you are waiting for? And when was the last time anyone from your agency inspected the operation that grew or packed these peppers, and what did that inspection find?

To CDC. You post outbreak notices for clusters a fraction of this size. Where is the notice for an outbreak that has now reached 212 confirmed illnesses across at least two states with a serotype laboratories identified? How many states hold isolates matching this outbreak strain — PulseNet knows the answer today, and the public does not. What are the earliest and latest illness onset dates, and will you publish the epidemic curve? How many people have been hospitalized, and has anyone died? And when did PulseNet first flag this cluster, given that FDA’s traceback did not begin until July 22 and Minnesota’s exposure window opened on June 14?

To Minnesota and Colorado. Minnesota, you have released a case count but not the number of hospitalizations, not the age range, and not whether anyone has died. Will you? Your investigators interviewed 84 people, and nine of them ate at Mexican-style restaurants other than Chipotle — which restaurants, have those companies been notified, and have they pulled anything? Colorado, your July 28 alert told the public you had logged more than 250 Salmonella cases since July 1 against a five-year July average of 125, and you have since told a national news outlet that 110 of them belong to this outbreak. Will you say that on the record, with an onset date range and a description of what your patients ate? 

To Chipotle. Your statements have been careful, and I want to be fair about that — you found a common lot through your own traceability system, you pulled it, and Minnesota says you cooperated fully and turned over records. Now the harder questions. How many of your restaurants received peppers from this lot, and in which states? Some outlets have reported you removed the peppers from “select restaurants” and others that you removed them across the country; those are very different statements and only you know which is accurate. Your first public statement went out on August 3, a day before the pull — when did FDA or a state health department first contact you about this outbreak? Who is the supplier? You know the name; you had to know it to identify the lot. Was the product domestic or imported, what audit and test records did that supplier provide you, and when were they last verified? Did you notify the other foodservice retailers who received product from the same lot, and if so, when and how? And after everything built into your food safety program in the years following the deferred prosecution agreement, what part of that system caught this, and what part of it did not?

To every other restaurant company. Minnesota has told you, publicly, that the contaminated ingredient was served somewhere other than Chipotle. Did you receive peppers from this supplier or this lot? That question has a yes-or-no answer and every one of you should give it today. If yes, when did you learn, what did you pull, and did you tell your customers? If your answer is that you cannot tell whether you received this product, then say that publicly too, because it is the most important fact any of you could disclose — it would mean that in 2026 a national restaurant chain cannot trace a raw, ready-to-eat ingredient back through its own supply chain in under two weeks.

To the produce industry. Which grower, which growing region, and what water did these peppers touch? Jalapeños are eaten raw. There is no kill step, no cook, no wash that reliably removes Salmonella from a pepper’s surface or from inside a stem scar — which means every control that matters happened in the field, in the water, and in the packing house. What preventive controls under the Produce Safety Rule applied here, who audited them, and when? And the question the industry has been dodging since 2008: after the Saintpaul outbreak sickened 1,442 people in 43 states, after federal investigators spent months chasing tomatoes because nobody could trace a pepper, the industry promised that lot-level traceability was coming. Fresh peppers sit on FDA’s Food Traceability List precisely because of what happened in 2008. Compliance with the traceability rule has been delayed again. Would those records, had they existed on July 22, have produced the grower’s name in a day instead of leaving 212 people reading press statements two weeks later?

And one point for the growers who did nothing wrong, because the industry has had this backwards for eighteen years. Disclosing the supplier is not an attack on the produce business. It is the only thing that protects it. For as long as this outbreak has a vehicle and no name, every jalapeño in the country is under suspicion — the ones from the operation at fault and the ones from the hundred operations that did everything right, the domestic crop and the imported crop alike. Silence is not neutral. It spreads the accusation evenly across an entire commodity and leaves honest growers carrying the cost of somebody else’s contamination. That is precisely what happened in 2008, when investigators chased tomatoes for two months while growers who had never shipped a contaminated fruit watched their season collapse, and the peppers actually responsible kept moving. The fastest way to clear ten thousand acres of clean peppers is to name the one field that was not. Every hour that name is withheld, the growers who did this right are paying for the one who did not.

One last question, and it belongs to all of them. Minnesota’s top epidemiologist said Tuesday that she expects the case count to rise, not because people are still getting sick, but because it takes weeks to detect the ones already infected. Every institution above knows that. Every one of them knows that the people counted today were exposed in June and early July, and that whoever gets counted next was exposed while this investigation was already underway and nobody had said a word. That is the cost of the silence, and it is measured in people.

If any of these get answered, I will post the answers. If they do not, that is worth posting too.

Minnesota went first, and Minnesota was specific. The Minnesota Department of Health is investigating an outbreak of Salmonella Javiana tied to jalapeños served at Mexican-style restaurants, and has identified 110 cases. Of the 84 sick people its epidemiologists have interviewed, 75 ate at a Chipotle between June 14 and July 14. The rest ate at other Mexican-style restaurants. Carlota Medus, the senior epidemiologist supervisor in the state’s foodborne diseases unit, said jalapeños are suspected as the vehicle, and that based on the evidence so far, the food that made people sick was served at other restaurants as well. Chipotle traced a common lot of peppers, pulled them from every restaurant that got them, and replaced them with product from different growers. Its chief corporate affairs and food safety officer said the peppers went to several food service retailers across multiple states.

Here is the part that is not yet nailed down.

NBC News reported Tuesday that Colorado health officials said testing had identified 110 cases associated with the same outbreak as Minnesota, that there are likely commonalities with the Minnesota cases, but that Colorado did not confirm whether its cases came from jalapeños or from Chipotle. 

What Colorado has published is a week older and points the same direction. On July 28, the Colorado Department of Public Health and Environment alerted the public to a significant increase in Salmonella cases: more than 250 reported since July 1, against a five-year average of 125 for the entire month of July. The state said its public health laboratory uses whole genome sequencing to compare genetic fingerprints and identify potentially connected cases, that it was coordinating with local agencies, CDC, FDA and partners in other states, and that federal investigators had not confirmed a specific food, restaurant, supplier or other source. Roughly 125 cases above normal, and 110 of them now said to belong to one outbreak. The arithmetic is consistent.

Now the things nobody has said out loud.

Nobody has said the Colorado cases are Javiana. Minnesota named its serotype. Colorado has not, in the July 28 release or in Tuesday’s statement. Until somebody does, “the same outbreak” is a characterization rather than a published fact.

Nobody has said whether the Colorado illnesses involve restaurants at all, much less Mexican-style ones, much less jalapeños. Colorado specifically declined to make that link.

Nobody has reconciled the numbers. Minnesota’s 110 and Colorado’s 110 come to 220. FDA’s outbreak table carries the investigation at 212, and the agency repeated that figure Tuesday while declining to identify a source. Two states now exceed the national count.

Nobody has named another state, though everyone has gestured at them. Minnesota says other states are contributing to the investigation and will not elaborate. Chipotle says the lot went to multiple states. FDA says it opened a traceback of multiple ingredients on July 22 and that it will provide additional information if and when there is an actionable public health update.

And nobody has named the grower. The peppers came from a lot, the lot came from a farm, and the farm has a name that Chipotle knew well enough on Tuesday to stop buying from it.

Consider what the phrase “associated with the same outbreak” actually requires. It is not a hunch. It means somebody put Colorado sequences next to Minnesota sequences and they matched. Colorado told the public on July 28 that it runs whole genome sequencing on every Salmonella isolate for exactly this purpose. Minnesota has been doing the same thing for thirty years. If a Colorado official can tell a reporter that 110 of that state’s cases belong to Minnesota’s outbreak, then the comparison has been made, the answer is known, and the only question left is who is willing to say it on the record and how long the public has to wait.

There is a reason to care beyond the counting. In the 2008 Salmonella Saintpaul outbreak — 1,442 sick in 43 states over a jalapeño investigation that spent months blaming tomatoes — the first pepper ever linked directly to an ill person came out of the home of a patient in Montezuma County, Colorado (she was my client), bought at a local Walmart. Colorado was where that investigation finally got physical evidence out of a sick person’s kitchen instead of out of a questionnaire. 

Two states, 220 people, one federal count of 212 that satisfies nobody, and a supplier whose name is sitting in a purchase order somewhere. I wrote yesterday that twenty-five years of Javiana history pointed at produce. It did. The history was never the hard part. Getting somebody to say the name out loud is the hard part, and it always has been.

At 4:13 this afternoon the Washington Post named the other five states. Arkansas, Iowa, Nebraska, New Hampshire and North Carolina, joining Missouri. That is the expansion of the largest cyclosporiasis outbreak this country has ever recorded, from nine states to fifteen, and it is attributed to a fourth person familiar with the investigation who is not permitted to say their name. The Post adds that the investigation continues to evolve and the number could change again. CDC did not respond to its request for comment.

I have just been back through every federal page. CDCoutbreak page says nine. Its investigation update says nine and still puts the count at 1,947. Its map of where people got sick says nine. Its surveillance page says nine. FDAadvisory says nine, is titled Investigation of 9-State Outbreak, and has not been touched since July 24.

This is how you found out today that your state is part of the largest outbreak of this parasite in American history. You read it in a newspaper. Behind a paywall. Sourced to somebody who is not allowed to be named.

None of that is a criticism of the Post. Lena Sun and Rachel Roubein have been ahead of this outbreak for three weeks and they have been right every single time. On July 24 they had the last expansion too, and that one at least had an agency update posted behind it. This one does not. What has changed in twelve days is not the quality of the journalism. It is that a newspaper has quietly become the announcement channel for a federal foodborne-illness investigation, and the federal government has become the place you go afterward to see whether it has caught up.

Now the arithmetic, because it is worse than it looks. Those fifteen states report 21,393 cases among themselves — Michigan alone reports 11,508. The federal figure for the outbreak is 1,947. Put the other way: thirty-five states are not in this outbreak, and they report 1,902 cases between them.

Two things in the new list are worth stopping on.

The first is Nebraska. Nebraska is not on Taylor Farms distribution list. The companys own recall noticenames twenty-seven states that received the recalled shredded iceberg and Nebraska is not among them. Neither is West Virginia, which has been in this outbreak since the beginning. Two of the fifteen outbreak states are therefore places where, according to the company that made the product, the product never went.

Douglas County, which is Omaha, reported on July 20 that eating at Taco Bell was the most common exposureamong the cases it had interviewed, with nearly two thirds naming the restaurant in the two weeks before they got sick. Nebraskans were eating this lettuce at Taco Bell in a state where, according to the company, the lettuce was never sent. The explanation is not sinister, and it is not complicated. The recall notice records where Taylor Farms shipped directly, and Taco Bells own distributors likely carried it the rest of the way. Which means the twenty-seven-state list is a shipping manifest and not a map of where this lettuce was eaten, and everyone who has been checking it to see whether their state was affected has been reading the wrong document.

North Carolina is the reversal in the list. A week ago, NCDHHS told the public that its increase did not appear to be associated with the Taco Bell outbreak, and that its patients were reporting parsley and cilantro more often than expected. Today the state is in the lettuce outbreak. It may still turn out that North Carolina was right about there being more than one thing happening — 718 cases is a great deal to explain with one restaurant chain, and the state said plainly that many of its patients ate neither herb.

And New Hampshire raises the question I flagged this morning, before the names came out. New Hampshire has thirty-three cases and seventeen of them are tied to recalled Taylor Farms lettuce at Cheshire Medical Center in Keene — a hospital, not a Taco Bell.

The fifty states are reporting 23,295 cases today. Michigan added 274 today alone and has recorded two deaths. CDCs outbreak page acknowledged those two deaths yesterday. Its investigation update, on the same site, still says no deaths have been reported, and FDAs advisory still says zero. All of them still say nine states and have since July 24.

The Post says the number of states could still change. I believe that. And when it does, we will all read about it in the Post.

The Washington Post reported at 2:21 this afternoon, Lena H. Sun and Rachel Roubein reporting, that CDC is expanding this outbreak from nine states to fifteen, adding six where illnesses have been traced to shredded iceberg lettuce from central Mexico. Three individuals familiar with the investigation are the source for the expansion itself, and they spoke anonymously because the investigation is ongoing. CDC did not immediately respond to the Posts request for comment.

Missouri is not one of the anonymous parts. Missouri is on the record. The state health departments spokesperson, Lisa Cox, told the Post that Missouri is one of the states being added, and that patients interviewed at length by state and local investigators said they consumed Taco Bell before getting sick. Information on the other five states was not immediately available.

That distinction matters more than it looks. A state health department putting a named spokesperson behind the statement that it is joining a federal outbreak — while no federal page yet says so — is a state getting out in front of the agency that is supposed to be counting it. Yesterday a CDC spokesperson told a Kansas City television station that the remaining thirty-two states, Missouri among them, were unrelated to this outbreak. Yesterday Missouri said it expected to be added. Today Missouri says it is being added, by name, on the record. The correction took about twenty-four hours, and it still has not reached a federal website.

I checked every federal page before writing this. None of them says fifteen. CDCoutbreak page says nine and is titled nine. Its investigation update says nine. Its surveillance page says nine. FDAadvisory says nine, is titled Investigation of 9-State Outbreak, and is still stamped July 24 — eleven days — with Total Illnesses 1,947, Hospitalizations 98, Deaths 0. On July 24 the same reporter had the last expansion and attributed it to an agency update already posted, with a CDC newsroom release behind it.

Now the paragraph in the Post story that I think is the most important thing published about this outbreak in two weeks, and it has nothing to do with the state count.

Taylor Farms told the Post that the recalled lettuce was distributed from June 29 through July 16, through food-service channels and retail stores in twenty-seven states. FDAs own outbreak advisory says the illnesses in this cluster began on dates ranging from June 22 to July 20.

Read those two sentences against each other. The first person in the federal governments own outbreak got sick seven days before the company says the recalled product started shipping. Cyclosporiasis takes about a week to make you sick, and CDC puts the range at two to fourteen days. Work it backwards: a June 22 onset means that person ate the lettuce somewhere around June 15, and no later than June 20 even on the fastest incubation the agency recognizes. That is nine to twenty-one days before the recall window opens.

There are only a few explanations. The recall window is drawn too narrowly. Or the earliest cases in the cluster ate product that shipped before June 29 and is not covered by the recall. Or the onset dates are wrong. I do not know which, and neither, apparently, does anyone who has published on it. What I do know is that the Post asked Taylor Farms how many pounds of product the recall covered and where shredded lettuce was distributed before June 29, and the company declined to provide it. That second question is the one that matters, and the refusal to answer it is the most consequential thing Taylor Farms has done since the recall.

Nine days is not a technicality in an outbreak this size. Michigan alone reports 11,508 cases. If contaminated product moved before June 29, then the recall — the only recall of this entire season — never reached it, and it was eaten, and nobody has ever gone looking for it. A recall is a boundary drawn on a calendar. Taylor Farms drew this one and will not say what is on the other side of the line.

Two more things in the story worth pulling out. The Post notes that federal investigators have publicly linked illnesses to only a portion of the states where the company said the recalled lettuce went. That has been true since July 20 and it is good to see it in print. And federal officials are investigating outbreaks and illnesses in more than two dozen additional states that have not been linked to the fifteen-state outbreak, with sources that have not been identified or tied to Taylor Farms.

Which raises the question I have been asked more than any other since the Post story went up: is this outbreak Taco Bell, or does it reach Taylor Farms other customers? As the federal pages are written tonight, it is Taco Bell and nothing else. FDAadvisory says 1,947 people infected with Cyclospora and reporting exposure to Taco Bell. Its list of affected restaurants names exactly one chain. No other company appears anywhere in the case definition.

The recalled product went a great deal further than that. FDAs own recall notice says the shredded iceberg went out between June 29 and July 16 to twenty-seven states. Consumer Reports reported that alongside Taco Bell, the recalled lettuce went to Walmart stores, Jack in the Box restaurants and major foodservice distributors including Sysco, in that same window. Jack in the Box says it learned of the problem on July 16, a day before FDAs announcement, pulled product from restaurants served by its Texas distribution center, and has had no known illnesses. And the proportion matters: thirty-three of the thirty-five recalled items went to foodservice and only two went to Walmart retail. The overwhelming majority of this lettuce went to restaurants and distributors, and the federal count covers one restaurant chain.

Missouri is a good illustration, because it had two routes and not one. Lisa Cox says Missouri is joining on the strength of patient interviews pointing to Taco Bell. But FDAs own advisory lists the states where recalled Marketside bags were sold at Walmart — Alabama, Arkansas, Florida, Georgia, Indiana, Kansas, Kentucky, Louisiana, Missouri, Mississippi, Oklahoma, Tennessee, Texas, Virginia and West Virginia — and Missouri is on it. The recalled bags were on Missouri shelves at the same time the recalled lettuce was in Missouri Taco Bells.

And we already have the proof that non-Taco-Bell exposure to this product makes people sick, because New Hampshire published it. Seventeen people, all at Cheshire Medical Center in Keene, all tied to recalled Taylor Farms lettuce. A hospital cafeteria, not a Taco Bell, in a state that is not among the nine. That is not a theory about what the case definition might be missing. It is a documented cluster sitting outside it.

A note on the twenty-seven. The chart at the bottom of this post counts twenty-eight states as having received the recalled lettuce, and the difference is West Virginia. Taylor Farms own distribution list runs to twenty-seven states and West Virginia is not on it. West Virginia is one of the nine outbreak states. It has been in the federal outbreak since the beginning, and it is not on the companys list of places the recalled product was sent. I have flagged that since July 20, and it has never been explained.

Michigan updated this morning. MDHHS now reports 11,508 cases, up 274 from yesterday, with 193 hospitalizations as of July 30 and two deaths. The fifty-state total is now 22,957. Michigan was the only state that moved: North Carolinas dashboard, which refreshes Tuesdays, was still stamped July 28 when I fetched it directly, and CDCs surveillance page had not refreshed either.

When the expanded page does post, here is the test. The 1,947 is not a count of illness. It counts people who were infected and reported eating at Taco Bell, in nine named states. Widen the list to fifteen and either the number grows substantially, in which case the parasite was always in those states, and the case definition was hiding it, or six states get added and the number barely moves, in which case the definition is doing the work rather than the disease. Missouri alone reports 1,095 cases and its investigators have already tied patients to Taco Bell by interview. Watch what happens to the federal figure.

On the federal injury numbers. CDCs surveillance page, updated July 28 with data through July 27, reports 6,707 laboratory-confirmed domestically acquired cases across forty-five states, more than 11,500 awaiting confirmation, and 423 hospitalizations. FDAs advisory says ninety-eight. Thirteen states publish a hospitalization figure of their own and those thirteen come to 426.

What is being countedHospitalizationsDeaths
FDA, nine-state lettuce outbreak (stamped July 24)980
CDC national surveillance, through July 274232 (acknowledged Aug 3)
The thirteen states that publish a figure4262 (Michigan)

These are not identical measures, and I am not adding 426 to 423. CDC counts hospitalizations among laboratory-confirmed domestically acquired cases; the states count among everything they have, probable cases included, across thirteen different dates, and Michigans 193 are certainly inside CDCs 423. What the arithmetic establishes is direction. Thirteen states already publish more hospitalizations than the national surveillance total and more than four times what the federal outbreak advisory describes. And 426 is a floor, because the state hospitalization figures are older than the state case counts: Ohioninety-six date to July 17 when Ohio had 1,316 cases, and Ohio now has 4,013 with no update since. On deaths, Michigan says two, CDC acknowledged two on August 3, and FDA still says zero.

Where each state stands now, with the source for every number. Michigan is the only row that changed today.

State2026 cases reportedRecalled lettuceWhere the number comes from
Alabama28 (Jul 20); 2 hosp.; 8 tied to two restaurant clustersYesADPH news release
Alaska5 (Jul 16)NoAlaska DOH advisory
Arizona19 (Jul 17)NoAZ DHS, via roundup
Arkansas123 (Jul 30); 75 in Benton CountyYesADH via KNWA
California41 provisional (Jul 14)NoCDPH NR26-024
Colorado150 (Jul 17); 4 hosp.NoCDPHE, via roundup
Connecticut35YesCT DPH press release
DelawareNo count publishedNoCDC surveillance
Florida254 since May 1 (Jul 25); 264 calendar yearYesFDOH via News4Jax
Georgia11-30 since May 1 (Jul 17)YesGA DPH, via roundup
HawaiiNo count publishedNoCDC surveillance
IdahoNo count publishedNoCDC surveillance
Illinois532 (Jul 29); 23 hosp. (Jul 16)YesCNN tracker
Indiana1,176 (Jul 31)YesIDOH cases by county
Iowa226 in 48 counties (Jul 30); 47 travel-relatedYesIowa HHS weekly report
Kansas461 (Jul 29); 20 hosp.YesCNN tracker / KDHE
Kentucky468 (Jul 29); 7 hosp. (Jul 20)YesCNN tracker
Louisiana1-10 (Jul 17)YesLA DOH, via roundup
MaineNo count publishedNoCDC surveillance
Maryland69 (Jul 17)YesMD DOH, via roundup
Massachusetts18 (Jul 17)YesMA DPH, via roundup
Michigan11,508 (Aug 4); 193 hosp. (Jul 30); 2 deathsYesMDHHS / CBS Detroit
Minnesota41 since May 1 (Jul 17)NoMDH, via roundup
MississippiNo count publishedYesFDA distribution list
Missouri1,095 (Aug 2); doubled in one week; 90 in Boone CountyYesDHSS via KCTV5 / STLPR
MontanaNo count publishedNoCDC surveillance
Nebraska49 (Jul 17)NoNE DHHS, via roundup
NevadaNo count publishedNoCDC surveillance
New Hampshire33 confirmed (Jul 28); 2 hosp.; 17 tied to recalled lettuce at Cheshire Medical CenterYesNH DHHS / NHPR
New Jersey46 (May 1-Jul 11)YesNJDOH news release
New MexicoNo count publishedNoCDC surveillance
New York753 since May 1 (Jul 27 data); 787 calendar yearNoNYSDOH
North Carolina718 since May 1 (Jul 27 data); 24 hosp.; 728 calendar year; 432 in Wake CountyYesNCDHHS / dashboard
North DakotaNo count publishedNoCDC surveillance
Ohio4,013 in 80 counties (Jul 31); 96 hosp. (Jul 17); ODH puts Lucas Co. at 554, the county health dept. at 1,218 (Aug 3)YesODH via WOSU / Toledo Blade
Oklahoma303 (Jul 28); 18 hosp.YesOSDH via KSWO
Oregon23 in 2026 (Jul 24)NoOregon Health Authority
Pennsylvania82 (Jul 29); reported voluntarilyYesCNN tracker
Rhode Island4 since May 1 (Jul 17)NoRI DOH, via roundup
South CarolinaNo count publishedYesFDA distribution list
South DakotaNo count publishedNoCDC surveillance
Tennessee11-30 (Jul 17)YesTN DOH, via roundup
Texas68 (Jul 13); 15 hosp.YesTexas DSHS
Utah1-10 (Jul 17)NoUT DHHS, via roundup
VermontNo count publishedNoCDC surveillance
Virginia126 total (Jul 23); 66 domestic, 31 travel, 29 pendingYesVirginia DH
Washington38 (May 1-Jul 17)NoWashington DOH
West Virginia268 (Jul 31); 19 hosp.YesWV OEPS
Wisconsin160 (Jul 29); 3 hosp.; 50 domestically acquiredYesWisconsin DHS
WyomingNo count publishedNoCDC surveillance
Nine outbreak states18,8119 
Received the recalled lettuce21,83328 
Did not receive it1,12422 
All fifty states22,95750 

Thirteen states in that table publish no count at all. Eleven more trace to a national roundup last refreshed July 17, and several of those are bands rather than counts — Georgia and Tennessee published as eleven to thirty, Louisiana and Utah as one to ten. I use the bottom of every band, which is one of several reasons the total is a floor.

Twenty-seven days remain in the season CDC defines as May 1 through August 31. Tonight the outbreak is fifteen states according to a newspaper, nine states according to the government, and 22,957 cases according to the fifty health departments doing the counting. And the company at the center of it will not say how much lettuce it recalled, or where the lettuce went in the weeks before the recall window it drew for itself.

Chipotle Mexican Grill confirmed today that it traced ingredients through its supply chain after learning of a potential Salmonella outbreak, identified jalapeños from a common lot as a possible source, pulled them from every restaurant that received the product, and replaced them with peppers from different growers. Shares fell 7 percent on the afternoon. The illnesses surfaced first in Minnesota, where Bloomberg reported 110 people sick. Of 84 who have been interviewed, 75 said they ate at a Chipotle. A Minnesota Department of Health spokesperson says the full scope is not known that other states are involved, and that some of the sick ate at other restaurants entirely.

Read that last part again, because it is the whole case. If people are getting sick at restaurants that are possibly not Chipotle, then this is not only a Chipotle problem. It is a pepper problem, and the peppers went somewhere besides Chipotle.

Which brings me to the U.S. Food and Drug Administration. Its CORE outbreak investigation table was last updated July 29 and still carries two unsolved Salmonella investigations with no product named. Ref #1395, Salmonella Javiana, jumped from 106 cases to 212 with sampling initiated. Ref #1387, Salmonella Oranienburg, sits at 90. Both are logged as “not yet identified.” I wrote about the Javiana investigation yesterday — 212 sick, twenty-five years of outbreak history pointing straight at produce, and still no product named. Today a state health department and a restaurant company did in public what the federal table has not done in six days. A sick person looking to the FDA this morning for a reason to throw something out of the refrigerator got nothing.

Jalapeños have a record, and it is not a good one. In 2008, Salmonella Saintpaul sickened 1,442 people across 43 states, the District of Columbia and Canada, hospitalized at least 286, and may have contributed to two deaths. Investigators chased raw tomatoes for months and destroyed the domestic tomato market doing it. The New England Journal of Medicine account of the investigation is the definitive one: eating at a Mexican-style restaurant, eating pico de gallo, and having a raw jalapeño in the house all tracked with illness, jalapeño peppers were implicated in every restaurant cluster with an identified ingredient, and the outbreak strain turned up in a jalapeño in Texas and in irrigation water and a serrano pepper on a Mexican farm. Tomato traceback never converged on anything. Peppers get eaten raw, they get diced into salsa by the pound, and they are grown and irrigated in places where the water has never been the subject of a serious inspection.

Now the Chipotle record, because it matters what a company already knows.

In July 2015, five patrons of the Chipotle at 1415 Broadway in Seattle became ill with E. coli O157:H7 with onsets between July 28 and 31. Three were hospitalized. It was never announced publicly — I wrote about that silence at the time.

In August 2015, roughly 80 customers and 18 employees fell ill with norovirus at the Simi Valley, California store after a sick employee was kept on the schedule. The Justice Department later put the figure at 234.

From August into September 2015, Minnesota logged 64 cases of Salmonella Newport across 22 Chipotle locations, with nine hospitalized and meal dates from August 16 to 28. MDH and the Minnesota Department of Agriculture identified tomatoes as the source and traced them toward the farm. A produce ingredient, in Minnesota, found by the same state lab that is running today’s investigation.

From October into December 2015, two genetically unrelated E. coli O26 outbreaks ran through the chain. The CDC’s final update counted 55 cases in 11 states with 21 hospitalized in the first, and five cases in three states in the second. No food or ingredient was ever identified in either one.

In December 2015, 141 people were sickened by norovirus at the Cleveland Circle store in Boston. Prosecutors later said it began when an apprentice manager told a regional manager he had vomited on the job and was ordered to keep working. It was not reported to company food safety officials. He took a sick day, came back, and helped package a catering order for the Boston College basketball team. Players got sick.

In July 2017, more than 135 people were sickened by norovirus at the Sterling, Virginia store. In July 2018, 647 people fell ill with Clostridium perfringens after eating at the Powell, Ohio store between July 26 and 30. The store closed on the 30th and reopened on the 31st.

Then came the bill. On April 21, 2020, the Department of Justice charged Chipotle with two counts of violating the Federal Food, Drug, and Cosmetic Act by adulterating food held for sale after shipment in interstate commerce — a strict liability misdemeanor that requires no proof of intent, only that adulterated food was served. The criminal information was filed in federal court in Los Angeles and covered five incidents in Los Angeles, Simi Valley, Boston, Sterling and Powell, more than 1,100 people sickened between 2015 and 2018. The company admitted its practices — food held out of temperature; sick employees kept on the line — made people ill. It paid a $25 million criminal fine, the largest ever imposed in a food safety case, and entered a three-year deferred prosecution agreement requiring a comprehensive food safety compliance program built with its Food Safety Council and covering audits, restaurant staffing and employee training. FDA’s Office of Criminal Investigations ran the investigation. If Chipotle complied for three years, the government would move to dismiss. The E. coli outbreaks were never part of the criminal case, and no individual was ever charged. My post from that day is still up.

That agreement’s three-year term expired in 2023.

One more for the stack, because almost no one knows it happened. In December 2021, a four-case E. coli O121:H19 cluster hit two Chipotle stores in Rochester, Minnesota alongside two Panera locations in Washington. FDA opened a traceback, both legs converged on a single processing facility, and the agency redacted the name. It never issued a public warning and said there was no actionable advice for consumers. The King County environmental assessment, which FDA never linked into the national record, names the company behind the redaction four separate times: Taylor Farms of Salinas.

Four sick people, two states, a converged traceback, and silence.

If jalapeños hold up here, this will be the first produce-vehicle outbreak at Chipotle since the deferred prosecution agreement lapsed, and the second one in Minnesota. It will also be the second time in eleven years that a Minnesota state epidemiologist named the ingredient before the federal government did. That is not a knock-on Minnesota, which runs one of the two or three best foodborne disease units in the country. It is a knock on a system in which whether you find out you were poisoned depends on which state you happened to be standing in when you ate.

The peppers came from a grower. The grower has a name. Somebody knows it today, and the people counting 110 sick in Minnesota — and however many more are sick in states that have not been named yet — deserve to know it too.

Look at the picture above before you read another word. Ninety-two boxes. Fifteen points of service across seven states, feeding fourteen distributors, four processors, sixteen farms and forty-three individual ranches. Arrows in every direction, legs that cross, and a handful of places where several lines converge on one box. That is what a completed federal traceback investigation looks like when somebody draws it.

It comes from a paper called An Overview of Traceback Investigations and Three Case Studies of Recent Outbreaks of Escherichia coli O157:H7 Infections Linked to Romaine Lettuce, written by eight people at FDA’s Center for Food Safety and Applied Nutrition and three at CDC. The paper says outright that FDA is home to traceback investigation experts who use a standardized process to initiate, execute and interpret these investigations. It then walks through three romaine outbreaks — Yuma in 2018, Santa Maria in 2018, Salinas in 2019 — and publishes the diagram for each one. Those three outbreaks together caused 474 illnesses, 215 hospitalizations and five deaths, and traced back to 45 farms and 84 ranches.

Now look at the diagram again and notice what is not in it. There is not a single company name. Every box is a letter. POS A. Distributor H. Farm C. Ranch AQ. FDA published the entire supply chain, across a hundred pages of records and dozens of businesses, without naming one of them. Whatever the reason may be that we have no such diagram for the Cyclospora outbreak, confidentiality is not it. The agency hid that problem years ago and showed its work anyway.

Here is where we actually are in the Cyclospora outbreak. Fifty state health departments now report 22,683 cases of cyclosporiasis this season. Two people are dead in Michigan. CDC’s outbreak page describes 1,947 of those people in nine states, and its surveillance page carries 6,707 lab-confirmed cases plus more than 11,500 additional cases awaiting analysis. FDA’s advisory lists product distributed to 28 states. What nobody has published is a diagram. Not a redacted one, not an anonymized one, not a partial one for a single leg. Nothing.

What we have instead is a recall covering only seventeen days of shipped product (we still have nothing about product shipped earlier when illnesses happened in April, May and June), a list of the states that product reached, and an assertion that the epidemiological data is overwhelming as to the Taco Bell and Taylor Farms cluster. I am not disputing that assertion. I am saying it is an assertion. The traceback is the evidence, and the diagram is how the evidence gets shown to people who did not sit in the meetings.

The paper is also candid about why these investigations fail, and every reason it names is present in this outbreak. It lists the time it took to initiate a traceback, limited product-identifying information moving through the supply chain, a lack of compatibility between record-keeping systems, and the commingling of product from multiple suppliers. Those four things, the authors write, delayed identification of the farm source and left the root cause of contamination unidentified. FDA said that about itself, in a peer-reviewed journal, five years ago. 

By the way, the rule that would fix the record-keeping half of it has been pushed to 2028.

And this is not a technique that only works on bacteria. It has been done for this exact parasite. In 2013, investigators in Nebraska and Iowa ran a regional traceback on 227 confirmed cases and a multistate traceforward that tied romaine shipped between June 2 and June 6, from a single Mexico-origin field to 189 illnesses across seven states. They published flowcharts of the distribution channels. FDA’s own environmental assessment that year narrowed the source to three ranches of interest among two growers in Guanajuato. Same parasite, same country of origin, the same company (Taylor Farms) at the center of it, with worse tools and a fraction of the illnesses. They did the work and they showed it.

There is now a specific reason this matters beyond principle. A CDC spokesperson has told reporters that cases in the remaining thirty-two states are unrelated to this outbreak linked to Taco Bell and Taylor Farms and are being investigated as separate clusters driven by different foods. That is not an epidemiological aside. That is a traceback claim, and it is the strongest one anybody at the federal level has made all summer. If the legs from New HampshireAlabamaMissouriNorth Carolina and Iowa genuinely do not converge on the same processor, then FDA has drawn diagrams showing exactly that, and those diagrams are the single most reassuring document the government could release. If it has not drawn them, then nobody knows whether they converge or not, and the claim rests on something other than a traceback.

The 2015 import alert on Puebla cilantro is the model for how this reads when an agency is being straight with the public. FDA said in that document that no single supplier, distributor, farm or packing house could explain all of the illnesses, and that contamination was attributable to multiple farms and packing houses. That is a hard thing for an agency to say. It is also exactly the kind of finding a diagram makes legible, because you can see the legs that fail to meet.

What I am asking FDA to publish is not complicated, and it does not require naming anybody, although there are many times they should and do not. How many points of service were traced, and from which states. How many distributors, processors, farms and ranches the traceback identified. The level of convergence — whether any single processor, farm or ranch appears in every leg, or whether the lines stop at a processor, or whether they do not meet at all. Whether any one entity can account for all the illnesses, or whether this is the Puebla answer again. Which of the six open Cyclospora investigations FDA is now running each diagram belongs to. And the diagram itself, lettered exactly like the one above.

FDA drew that picture for an outbreak that sickened a few hundred people, and it took a peer-reviewed article to get it into public view. Twenty-two thousand six hundred and eighty-three people have been counted this season by their own state health departments. Two families are burying somebody. Twenty-eight days remain in the season, and when it closes the counts flatten and the attention leaves. A traceback diagram is a piece of paper. We are owed the piece of paper.

Two people are dead in Michigan, and I want that sentence to stay at the top of everything I write this week. The Michigan Department of Health and Human Services announced this morning that two deaths have been identified as part of the cyclosporiasis outbreak affecting the state, that both individuals had significant underlying health conditions that may have been impacted by cyclosporiasis and dehydration. Those are the first deaths anywhere in this outbreak.

This has been a moving target all day. Friday night I published 21,452. This morning, with Michigan’s new figure and the deaths, I published 21,913. This afternoon, after going back through all fifty states one at a time, I published 22,181. Tonight it is 22,683. Michigan is at 11,234 with 193 hospitalizations — but the largest single move of the day did not come from Michigan, and it did not come from any state I was watching.

Missouri has 1,095 cases. The state Department of Health and Senior Services publishes a communicable disease report every Sunday, and the August 2 report put the state at 1,095, against fewer than 600 a week earlier. Boone County alone has 90. The three-week series is 216 on July 19, 593 on July 26, and 1,095 on August 2 — roughly doubling each week for three weeks running. Missouri normally logs about a dozen cases a year. This is something on the order of ninety times normal, in a state that is not part of the federal outbreak.

Now the part that ought to stop people. A CDC spokesperson told KCTV in Kansas City that cases in the remaining thirty-two states, Missouri included, are classified as unrelated to this outbreak and are being investigated as separate clusters driven by different foods. In the same news cycle, St. Louis County health officials said that people in their area who got sick reported eating at Taco Bell.

Set those two statements beside each other and hold them there. Missouri received the recalled Taylor Farms lettuce — it is on FDA’s own distribution list. Missouri has 1,095 cases. A Missouri county health department says its patients report the same restaurant chain that defines the nine-state outbreak. And the federal position is that none of it is related, driven instead by different foods that nobody has named, in clusters nobody has described.

Both statements can be true. It is entirely possible that St. Louis County residents ate at Taco Bell because a great many people eat at Taco Bell, and that their illnesses trace somewhere else. That is exactly the kind of thing an epidemiologist rules in or out with a case-control study, and it is the kind of thing a health department publishes when it has done one. What is not acceptable is asserting the negative without showing the work. Somebody at CDC has decided that 1,095 Missourians are not part of this outbreak. I would like to know what that determination rests on, how many of those 1,095 were interviewed, how many reported Taco Bell, and what the different food is.

The nine-state outbreak is not a description of who got sick. It is a description of who got interviewed in a particular way. The entry ticket has always been documented Taco Bell exposure captured through the federal case definition, which is why Michigan’s 11,234 produces a federal count of 1,947 and why Alabama’s two restaurant clusters and New Hampshire’s Cheshire cases sit outside it. Missouri now looks like the largest example yet of a state on the outside with a county pointing straight at the inside.

The two deaths belong in this same argument, because there is an unanswered question about which set of numbers, they sit in. CDC’s investigation page says it is aware of two cyclosporiasis-related deaths in people with underlying health conditions from Michigan as part of this outbreak, and that it will update its website to include laboratory confirmed cases, hospitalizations, and deaths. On that page, this outbreak means the nine-state cluster of 1,947 people. Michigan says the deaths are part of the cyclosporiasis outbreak affecting Michigan, which is 11,234 people. Those denominators differ by a factor of about six, and no agency has said which one applies. The FDA advisory is still stamped July 24 and still reads Deaths: 0.

The corrected arithmetic: 22,683 across fifty states, against the 18,207 the federal government describes when its two published figures are added together. The two counts are 4,476 apart, which is 24.6 percent of the federal base — the gap has crossed a quarter for the first time. The nine-state outbreak, at 1,947 people, is 8.58 percent of the illness this country is reporting.

One more thing about today that I think matters more than the total. The count rose 1,231 since Friday, and only 461 of that was a state filing a genuinely new daily report. Iowa at 226 rather than 57, Wisconsin at 160rather than 61, and Missouri at 1,095 rather than 593. I found those by going and reading what the states publish instead of what a national roundup said they published three weeks ago. Nobody got sick today because I looked. They were already sick, and the number simply had not traveled.

Indiana stays at 1,176 here. A national outlet reported this afternoon that Indiana has recorded nearly 1,349, and it may well be right — the state posts a new dashboard figure every weekday by one o’clock. But no Indiana newsroom carries that number, and WANE, 21Alive and Indiana Public Radio have written up every previous state figure as it landed. 

Where each state stands tonight, with the source for every number.

State2026 cases reportedRecalled lettuceWhere the number comes from
Alabama28 (Jul 20); 2 hosp.YesADPH news release
Alaska5 (Jul 16)NoAlaska DOH advisory
Arizona19 (Jul 17)NoAZ DHS, via roundup
Arkansas123 (Jul 30); 75 in Benton CountyYesADH via KNWA
California41 provisional (Jul 14)NoCDPH NR26-024
Colorado150 (Jul 17); 4 hosp.NoCDPHE, via roundup
Connecticut35YesCT DPH press release
DelawareNo count publishedNoCDC surveillance
Florida254 since May 1 (Jul 25); 264 calendar yearYesFDOH via News4Jax
Georgia11-30 since May 1 (Jul 17)YesGA DPH, via roundup
HawaiiNo count publishedNoCDC surveillance
IdahoNo count publishedNoCDC surveillance
Illinois532 (Jul 29)YesCNN tracker
Indiana1,176 (Jul 31)YesIDOH cases by county
Iowa226 in 48 counties (Jul 30); 47 travel-relatedYesIowa HHS weekly report
Kansas461 (Jul 29); 20 hosp.YesCNN tracker / KDHE
Kentucky468 (Jul 29)YesCNN tracker
Louisiana1-10 (Jul 17)YesLA DOH, via roundup
MaineNo count publishedNoCDC surveillance
Maryland69 (Jul 17)YesMD DOH, via roundup
Massachusetts18 (Jul 17)YesMA DPH, via roundup
Michigan11,234 (Aug 3); 193 hosp. (Jul 30); 2 deathsYesMDHHS / CBS Detroit
Minnesota41 since May 1 (Jul 17)NoMDH, via roundup
MississippiNo count publishedYesFDA distribution list
Missouri1,095 (Aug 2); doubled in one week; 90 in Boone CountyYesDHSS via KCTV5 / STLPR
MontanaNo count publishedNoCDC surveillance
Nebraska49 (Jul 17)NoNE DHHS, via roundup
NevadaNo count publishedNoCDC surveillance
New Hampshire33 confirmed (Jul 28); 2 hosp.; 17 tied to recalled Taylor Farms lettuce at Cheshire Medical CenterYesNH DHHS / NHPR
New Jersey46 (May 1-Jul 11)YesNJDOH news release
New MexicoNo count publishedNoCDC surveillance
New York753 since May 1 (Jul 27 data); 787 calendar yearNoNYSDOH
North Carolina718 since May 1 (Jul 28); 24 hosp.; 728 calendar yearYesNCDHHS / dashboard
North DakotaNo count publishedNoCDC surveillance
Ohio4,013 in 80 counties (Jul 31); ODH puts Lucas Co. at 554, the county health dept. at 1,207YesODH via WOSU / Toledo Blade
Oklahoma303 (Jul 28); 18 hosp.YesOSDH via KSWO
Oregon23 in 2026 (Jul 24)NoOregon Health Authority
Pennsylvania82 (Jul 29); reported voluntarilyYesCNN tracker
Rhode Island4 since May 1 (Jul 17)NoRI DOH, via roundup
South CarolinaNo count publishedYesFDA distribution list
South DakotaNo count publishedNoCDC surveillance
Tennessee11-30 (Jul 17)YesTN DOH, via roundup
Texas68 (Jul 13); 15 hosp.YesTexas DSHS
Utah1-10 (Jul 17)NoUT DHHS, via roundup
VermontNo count publishedNoCDC surveillance
Virginia126 total (Jul 23); 66 domestic, 31 travel, 29 pendingYesVirginia DH
Washington38 (May 1-Jul 17)NoWashington DOH
West Virginia268 (Jul 31); 19 hosp.YesWV OEPS
Wisconsin160 (Jul 29); 3 hosp.; 50 domestically acquiredYesWisconsin DHS / WPR
WyomingNo count publishedNoCDC surveillance
Nine outbreak states18,5379 
Received the recalled lettuce21,55928 
Did not receive it1,12422 
All fifty states22,68350 

Thirteen states in that table publish no count of their own. Eleven more still trace to a national roundup last updated on July 17. CDC says 45 states have cases.

Twenty-eight days remain in the season CDC defines as running from May 1 through August 31. Two families in Michigan are already on the other side of this. If a state can double to 1,095 cases while the federal government classifies every one of them as something else, then the number worth arguing about is not the total at the bottom of my table.