I was awake at three o’clock this morning doing arithmetic I did not want to do.  I have been thinking about this for weeks and considering the numbers.

Three outbreaks have shaped thirty-three years of my life. In the winter of 1993, undercooked hamburger from Jack in the Box carried E. coli O157:H7 into 732 people across four states. One hundred seventy-one of them were hospitalized. One hundred seventy-eight were left with permanent injury, most of it kidney and brain damage. Four children died, the youngest seventeen months old. In 2008 and 2009, peanut paste from a plant in Blakely, Georgia carried Salmonella Typhimurium out of Peanut Corporation of America and into 714 people in forty-six states. More than half of them were children and a fifth were under the age of five. Nine died. In 2011, cantaloupe from Jensen Farms carried Listeria monocytogenes into 147 people in twenty-eight states. One hundred forty-three of those 147 were hospitalized, ninety-nine percent of everyone who got sick. Thirty-three died and one pregnant woman lost her baby. The median age was seventy-eight. I represented the families of all thirty-three of the dead.

Put those three outbreaks end to end and they sickened 1,593 Americans and filled forty-six graves. The Cyclospora outbreak running right now has sickened at least 26,755 people. That is nearly seventeen times the three defining outbreaks of my career combined, and it has killed two.

There is a way to say that sentence that insults twenty-six thousand people, and I do not mean it that way. Let me deal with that first, because it matters more to me than the arithmetic does.

Nobody who has had cyclosporiasis has ever described it to me as mild. It starts about a week after exposure, sometimes as early as two days and sometimes as late as two weeks. Then comes watery, explosive diarrhea six to ten times a day, cramping, bloating, gas, nausea, a complete loss of appetite, and a fatigue that outlasts all of it. People lose ten, fifteen, twenty pounds. The worst part is that it comes back. It remits and relapses for days and sometimes for more than a month. People go back to work feeling human and are flattened again the following week. The only reliable treatment is trimethoprim-sulfamethoxazole, so a sulfa allergy leaves a patient with very little. There is no protective immunity afterward, which means a person can get it again. Three decades of listening to people describe foodborne illness, and this one is genuinely awful.

Two people in Michigan have died. Both, according to the state health department, had significant underlying conditions that may have been affected by cyclosporiasis and dehydration, and both became ill before the July 17 recall. I am not going to say more about them than that. Two families are living with this, and the fact that a statistician would call the case fatality rate low is of no use to either of them.

What kept me awake was not the two. It was what the number would have been if the organism riding on that lettuce had been one of the other three. CDC publishes the tool for answering that. Its burden model records, for each pathogen, the share of laboratory-confirmed patients who are hospitalized and the share who die. Checked against this outbreak first, the Cyclospora rate predicts about 1,739 hospitalizations out of 26,755 reported cases, and the thirteen states that publish a figure have reported 680 on a count that is still climbing. Here is what the same 26,755 people would have produced under each of the four organisms.

The model says the Cyclospora row should show zero deaths. It shows two. On the one organism where CDC’s model can be checked against reality this summer, it understates.

I do not have to take the model on faith for the other three, because I watched all of them. Jack in the Box hospitalized 171 of 732 and killed four. Run those observed rates against 26,755 and you get roughly 6,250 people in hospital beds and 146 dead. CDC’s model, built from entirely different data thirty years later, says 134. My own cases and the federal model land in the same place. That convergence is the part I could not put down.

The Listeria row in that table is not a real number and saying why is the most important thing in this piece. Twenty-six thousand seven hundred fifty-five invasive listeriosis cases would be roughly twenty-one years of the entire American burden of that disease compressed into one summer. It cannot happen, because Listeriakills people long before a count climbs that high. The largest listeriosis outbreak in American history was 147 people, and it killed thirty-three of them. The deadliest was 142 people in Los Angeles in 1985, and it killed forty-eight, twenty of them unborn. Neither one reached a hundred and fifty. Hold that against 26,755 and two.

That contrast is not a curiosity. It is the whole argument, and it is sitting in the last column of the table.

The last column is the underdiagnosis multiplier, CDC’s estimate of how many people actually get sick for everyone who is diagnosed and counted. Listeria is 2.1 in the older model and 1.7 in the 2025 rebuild. Cyclospora is 83.1. Listeria is 1.7 because it nearly always puts a person in a hospital where somebody draws a blood culture. Cyclospora is 83.1 because it sends a person home for a month. The multiplier is a severity index wearing a disguise, and this summer’s enormous count is enormous precisely because the organism is survivable. A lethal one would have produced a far smaller number that was far more complete. The size of the count and the mildness of the disease are the same fact.

The table also does not show what happens to the survivors. Five to ten percent of E. coli O157:H7 patients develop hemolytic uremic syndrome, which at 26,755 cases is between 1,338 and 2,676 people, most of them children. About half of them need dialysis, three to five percent die, and ten to thirty percent of the survivorscarry long-term kidney damage.

Now hold the exposure constant instead of the case count, which is the honest way to run this. Same field in central Mexico, same untested irrigation water, same processing plant at Doctor Mora, same 1.1 million bags of lettuce into a national grocery chain, same twenty-seven-state distribution footprint in FDA’s own recall record, same recall with its window set by shelf life rather than by contamination, reaching back only to product made in the last days of June against a median illness onset of June 22. Nothing in that chain is Cyclospora-specific. The water was not tested for anything. There is no kill step on a bag of lettuce for any organism and washing defeats none of them. The traceability rule that would have shortened the traceback is delayed to July 2028 for all of them, by Congressional direction. The agricultural water rule names generic E. coli as its only numeric criterion. Every one of those failures sits in exactly the same place if what was living in that canal had been O157 instead. And O157 does not send people home for a month. It sends children to dialysis, and in some instances, early deaths.

I do not have to imagine that one either. In 2006, E. coli O157:H7 came out of river water on a California ranch where a grass-fed cattle operation sat less than a mile from the spinach field, and it went into bags of fresh spinach shipped across the country. Two hundred twenty-five people were counted in twenty-seven states. One hundred sixteen of them were hospitalized. Thirty-nine developed hemolytic uremic syndrome. Five died. I litigated that one too. That is the same commodity, the same absence of a kill step, and the same water nobody was testing, twenty years earlier and with a different organism in it.

Here is the bleakest thing I know about my own profession. Every reform I have watched this country make came after a body count. Four dead children in 1993 got us pathogen reduction, hazard analysis, and E. coliO157:H7 declared an adulterant in ground beef. Five dead from spinach and nine dead from peanut butter got us the Food Safety Modernization Act and, eventually, a company president sentenced to twenty-eight years. Thirty-three dead from cantaloupe, seven months after that law was signed, put two growers in federal criminal court. Nobody legislated because 732 people had bloody diarrhea or because 147 people were hospitalized. They legislated because of the graves.

That means the arithmetic cuts the wrong way this time. This outbreak has produced more sick Americans than the three defining outbreaks of my career put together, and it has produced two deaths, and two deaths is not enough to move anybody.

I should say plainly what this exercise is and is not. Pathogens cannot simply be swapped at a constant case count, because attack rates and who gets sick differ by organism, and this summer’s 26,755 exists partly because Cyclospora leaves a large population alive to be counted. The rates I applied are observed among laboratory-confirmed patients while the 26,755 includes probable cases, so the run is generous. None of that changes the direction, and the direction is the only thing I am claiming.

We did not manage this outbreak. We drew the mild card. Twenty-six thousand seven hundred fifty-five people, at least 680 hospital beds and two graves is what the failure of an entire food safety system looks like when the organism happens to be the gentlest one in the deck. The national case count is still climbing. The next contaminated field will be planted in a few months, and nobody gets to choose what bug is living in the water when it is.

Luck is not a food safety program.

Saturday, August 8, 2026

Last Saturday this column was called The Week Cyclospora Stopped Being a Health Story and Became an Accounting One. This week the accounting stopped being the argument. On Monday it was announced that two people died in Michigan. On Tuesday a newspaper announced a federal expansion the government had not. On Wednesday the government’s own count went from 1,947 people in nine states to 6,358 in fifteen, and not one of those additional 4,411 Americans got sick that day. What changed was a definition. 

Two people died, and the state said no additional information would be provided. Michigan announced on Monday that both individuals had significant underlying health conditions that may have been impacted by cyclosporiasis and dehydration, that both fell ill before the July 17 recall, and that nothing further would be released. These are the first deaths anywhere in this outbreak. May have been impacted by is contributory language, not a finding on cause of death, and I will not stretch it into one. But I wrote on Monday and will say it again: who the hell cares that they had significant underlying health conditions. Most people who die in a foodborne outbreak do. It kills the very young, the very old and the immune compromised — that is who it has always killed, and the phrase does not make either loss smaller. I have represented families of people who died after eating a salad, and their losses were every bit as significant as anyone else’s. Nor has anyone described how a Cyclospora death gets counted in the first place.

The Washington Post announced the expansion two days before the government did. Lena H. Sun and Rachel Roubein reported Tuesday afternoon that CDC was expanding this outbreak from nine states to fifteen, attributed to three individuals familiar with the investigation, and by 4:13 p.m. Eastern they had named all six additions — Arkansas, Iowa, Missouri, Nebraska, New Hampshire and North Carolina. Every federal page still said nine that afternoon. Sun and Roubein have been right every time; this is about what has happened to the announcement channel for a federal outbreak investigation, and it was the second time in twelve days.

Then the federal count tripled, and nobody new got sick. On Wednesday CDC and FDA both posted it: 6,358 illnesses, fifteen states, 278 hospitalizations, two deaths. The day before, the same outbreak was 1,947 people in nine states. The case definition widened — until Wednesday a person entered by reporting they ate at Taco Bell, and now they can enter by eating at Taco Bell or by eating recalled Taylor Farms lettuce anywhere at all. The change was not announced, not dated, and the earlier series was not republished, so no trend line through it means anything. It is the point I have been making since mid-July. The federal number was never measuring a parasite. It was measuring one restaurant chain.

Taylor Farms says the lettuce shipped June 29. FDA says people started getting sick June 22.The company told the Post the recalled shredded iceberg went out June 29 through July 16, and when the paper asked what had shipped before June 29, it declined to say. CDC puts incubation at two to fourteen days, so a June 22 onset means an exposure at least nine days before the recall window even opens. New Hampshire published its own exposure window, the beginning of June through July 20 — four weeks wider than the company’s at the front, with a street address on it. A recall is a boundary drawn on a calendar. Taylor Farms drew this one and will not say what is on the other side of the line.

And Taylor Farms’ own page now says two different things about where the lettuce went. The company put up a Cyclospora information hub this week: central Mexico sourcing suspended for the season, production there halted since July 18, outside experts commissioned, roughly two thousand of its own samples negative since May, and a concession it spent July arguing around — that epidemiological evidence is a legitimate tool in an outbreak investigation. Read it twice, though. Its recall notice lists twenty-seven states without West Virginia; its own FAQ answers the same question with twenty-eight, West Virginia included. FDA’s advisory has the identical split between two of its sections. West Virginia has been an outbreak state since July 14, Nebraska is on neither list, and nobody has explained how a state joins an outbreak traced to a product the shipping records say never arrived. One line there is worth the whole page: the company says its water sources are tested for indicator organisms. That is generic E. coli — the only numeric criterion in the federal agricultural water rule, and the organism FDA’s own guidance says will not find this parasite. They are doing what the rule asks. The rule asks for the wrong test. CNN spent the week on the pattern behind all of it. Casey Tolan, Yahya Abou-Ghazala, Curt Devine and Kyung Lah counted at least five Cyclospora and E. colioutbreaks tied to the company over the past decade, and Lah put it on television Friday. A former senior FDA official says the company worked hard to keep the agency from naming it in the 2024 McDonald’s onion outbreak. FDA has not inspected the Guanajuato plant since 2019, and this year five of the company’s more than 160,000 Mexican shipments were physically inspected. People eat the evidence. A negative result on what is left in the cooler is not a finding of innocence, and it is no substitute for a name.

Michigan alone now reports more people hospitalized than the entire fifteen-state outbreak.The state finished the week at 12,485 cases with 279 hospitalizations. The federal figure for all fifteen states is 278. The same afternoon it reported that 279, Michigan lifted its bagged-salad advisory. Natasha Bagdasarian, the state’s chief medical executive, said the worst is behind us on the data available today, and was careful to say she meant Michigan. The state is also going from daily to weekly reporting, so the number that has driven this count all summer will now arrive once a week.

Ohio has now reported sixty-four times what it reported in all of last year. The state dashboard passed 4,900 cases, with 3,399 confirmed between July 4 and August 4 alone. Ohio confirmed 76 in all of 2025. Arkansas is at 237 against seven last year, 144 of them in Benton County, against the 41 Arkansans CDC counts in the fifteen-state outbreak. Add every state’s own published number and the floor is 26,755 people, up 5,303 in a week. CDC’s surveillance page reads 10,468 laboratory-confirmed plus 12,255 awaiting confirmation, unmoved since Tuesday. Hold any of those against the 249 cases reported nationally by this point last year.

FDA opened a brand-new Cyclospora investigation the same day it announced the old one had reached 6,358. The agency’s outbreak table now carries seven Cyclospora files and one of them names a food. Reference 1398 was posted August 5 — ten people, no vehicle. Reference 1385 went from 10 to 25, which FDA explains by saying it now includes illnesses with similarities in reported exposures — the agency telling you it has found a common exposure pattern in a file whose food it will not name. Six open files, 178 people, no product.

And I put the argument where people could check it. Thursday night Food Safety News ran fifteen things FDA and CDC could do about this parasite, four of which require no rulemaking, no appropriation and no act of Congress. Friday I wrote about recall readiness, which nobody measures until the week they need it. And earlier a box of t-shirts arrived, every one reading Test Infant Formula for Botulism — a different outbreak, four hospitalized babies, the same problem underneath it.

On the blog it was a week of old arguments picking up new proof. Thursday I said what I think of the Secretary’s July 21 assurance that this was under control, and set 2011 beside 2026 — sixty-eight people sick in ten states and CDC called it Restaurant Chain A, against FDA naming Taco Bell in the first sentence of its first advisory this July. Nothing changed in between but the decision to type the name. Friday I gave six reasons the produce trade association is wrong to tell CDC that endemic American water is behind this, the first being that the parasite does not multiply outside a person, so every oocyst in an American lake came out of an American. Marion Nestle told her readers what to do about all of it. And I sat down with KBJR in Duluth on the question I get asked most: when does food poisoning become a lawsuit. It becomes one when nobody will tell a sick family what happened to them.

The jalapeño outbreak got a country, a state and a distributor, but not a grower. CDC posted its Salmonella Javiana outbreak page Wednesday: 345 sick in 27 states, 36 hospitalized, with 177 of 191 interviewed reporting a Mexican-style restaurant and both Chipotle and QDOBA named. The peppers came from Sinaloa by way of Coast Citrus Distributors. The grower was identified by traceback and not named, and the recall carries no lot codes and no consignee list while CDC tells businesses to check whether their peppers are recalled. Javiana is a water organism. Two of the isolates carry antibiotic resistance, one of them multidrug-resistant and nonsusceptible to ciprofloxacin. And look at the sequence. Chipotle switched jalapeño suppliers on July 20 and QDOBA stopped serving them on July 28. FDA opened its traceback on July 22 and named Sinaloa and Coast Citrus on August 5. Two restaurant chains and a Minnesota epidemiologist got there first, and while they did, FDA’s own outbreak table still carried this file at 212 illnesses with no food identified. Three numbers for one outbreak, from one government, in one week. That is the sentence I have been writing about Cyclospora all summer, in a different aisle of the same store.

The recognized record of fresh-pepper Salmonella outbreaks in this country is exactly three, and all three came out of the same place. I put the whole history down this week. In 2008 SalmonellaSaintpaul sickened 1,442 people across 43 states, hospitalized at least 286, and investigators spent the summer wrecking the domestic tomato market before the strain finally turned up on a Mexican-grown jalapeño in a McAllen warehouse and in irrigation water on a farm in Mexico. In 2016 Salmonella Anatum sickened 32 people in nine states, and that one was solved only because FDA’s own laboratory happened to have sequenced an Anaheim pepper months before the outbreak existed. Now 2026. Three outbreaks in eighteen years is not a measure of how often peppers make people sick. It is a measure of how often anybody manages to prove it. After 2008 the Associated Press went through the border records and found chilies were the most-rejected Mexican crop of the preceding year, with Salmonella in eight percent of intercepted shipments. Nobody acted on it. Fresh chilies are grown outdoors in warm climates, irrigated with surface water, harvested by hand and eaten raw, and there is no wash that reliably clears the crevice where the stem meets the fruit. It is the same argument as the lettuce, and it has the same answer at the bottom of it, which is the water.

And the rest of the ledger, because it did not stop for the parasite. FDA’s outbreak table still carries the Midwest Poultry Services shell egg Salmonella Enteritidis outbreak at 98 illnesses and 26 hospitalizations across seventeen states, off a recall of more than nineteen million eggs. A Salmonella Oranienburg cluster sits at 93 with no food named at all. Still open too: the Listeria outbreak in Clover Hill requesón and soft ricotta, twelve sick, ten hospitalized, one dead; the E. coli O145:H28 investigation into GreenWise frozen blueberries sold at Publix; and the infant botulism outbreak behind the Nara Organics formula recall, four babies, all four hospitalized. On Friday USDA pulled 29,628 pounds of Argentine beef and 5,084 pounds of swai from the United Arab Emirates, both of which entered this country without import reinspection. Phyllis Entis has the international roundup at eFoodAlert, as she does every day.

That’s the week — two people dead, a federal count that tripled on a definition instead of an exposure, one state reporting more hospitalizations than the whole outbreak it belongs to, a company that will not say what shipped before the twenty-ninth of June, and a parasite that has made more Americans sick in one summer than the government’s own records show for the previous thirty-four years. And in the same seven days, jalapeños out of Sinaloa put thirty-six people in the hospital across twenty-seven states while the grower stayed anonymous. The season CDC defines runs through August 31. That is twenty-three days. Check back next Saturday.

About Bill Marler

William “Bill” Marler has spent more than thirty years as a food safety lawyer and advocate—work that began with the 1993 Jack in the Box E. coli outbreak and has never really stopped since. In the years that followed, he has represented victims in nearly every major foodborne illness outbreak in the United States. That case, and the movement it launched, is the subject of the book “Poisoned” and the Emmy Award–winning Netflix documentary of the same name. Bill’s work has been profiled in The New Yorker (“A Bug in the System”), the Seattle Times (“30 years after the deadly E. coli outbreak, a Seattle attorney still fights for food safety”), the Washington Post (“He helped make burgers safer. Now he’s fighting food poisoning again”), and many others.

Dozens of times a year, Bill speaks to industry, regulators, and universities across the United States, Canada, Europe, Africa, China, and Australia about a simple idea: outbreaks are preventable. He has testified before Congress on the Food Safety Modernization Act and teaches food safety at institutions including the Harvard T.H. Chan School of Public Health. He writes regularly about food litigation and food safety at Marler Blog, and in 2009 he founded Food Safety News, which he continues to publish.

Put two government documents side by side, fourteen years apart, and the whole argument about transparency in public health answers itself.

On July 16, 2026, FDA published its first public advisory on the Cyclospora outbreak. The opening sentence named Taco Bell. Five states, 1,644 confirmed illnesses, onset dates reaching back to May 13. The next day the advisory named the supplier, Taylor Farms de Mexico, and a recall followed within hours. There was no confirmed positive product sample. There still is not one. The agencies named the chain and named the shipper on epidemiology and traceback alone, while the investigation was wide open and while the lettuce was still moving through the country.

By contrast, on January 19, 2012, CDC published its final report on a Salmonella Enteritidis outbreak that had sickened 68 people in Texas, Oklahoma, Kansas, Iowa, Michigan, Missouri, Nebraska, New Mexico, Ohio and Tennessee. It called the source a Mexican-style fast food restaurant chain, Restaurant Chain A. 

The public learned the name only because a reporter asked a state for its files. Dan Flynn at Food Safety News broke it on February 1, 2012, after the Oklahoma State Department of Health answered a records request with a document naming Taco Bell. 

It was not the first time, and it was not a rule. In 2010 CDC gave the same label to two concurrent Salmonella outbreaks that sickened 155 people and hospitalized 42. Yet in 2006, when E. coli O157:H7 in shredded lettuce ran through Taco Bell restaurants in the Northeast and caused eight cases of hemolytic uremic syndrome, CDC named the company outright. Same agency, same chain, same kind of outbreak, opposite decision.

The reasons offered at the time came from Bob Tauxe, then CDC’s deputy director for foodborne, waterborne and environmental diseases: name a company only when the public can act on the name, this outbreak was over, cooperation is voluntary and relations must stay cordial, and there was no written policy at all — only decades of precedent. I answered him then. Nearly every outbreak is solved after the peak, so “it is over” is available in almost every case. A company that will cooperate only inside a witness protection program is telling you something about its commitment to safe food. Bad publicity is expensive; poisoning your customers is more expensive. And a practice nobody has ever written down is not a policy. It is a habit.

Three weeks after the Restaurant Chain A report, CDC announced an ongoing investigation into twelve people in five states infected with E. coli O26 and put Jimmy John’s in the headline. Twelve sick, named while the investigation was still open. Sixty-eight sick, unnamed after it closed.

Look at what the name actually did in 2026. On July 14 the company said health officials had confirmed no link to Taco Bell or to any ingredient, supplier, restaurant or retailer, even while Detroit-area stores were posting signs saying they could not serve lettuce, pico de gallo or guacamole. FDA published two days later and named it anyway. Within a day the lettuce was out of the chain’s supply nationwide and Taylor Farms had recalled every head of iceberg it had sourced from central Mexico. That is what a name is for.

The naming kept working after the recall. On August 5 the agencies expanded the case definition to take in anyone who ate the recalled Taylor Farms lettuce, not just anyone who ate at Taco Bell, and the federal count went from 1,947 illnesses in nine states to 6,358 in fifteen. You cannot make that move unless you have already named the product. In 2012 there was no product to name, because nobody ever found it, and because nobody was ever made to explain why.

The honest objection is that 2026 fits Tauxe’s stated rule perfectly. The outbreak was ongoing and contaminated lettuce was still on shelves, so the public could act on the name. Fair enough. But 2011 was the same species of outbreak: a produce item contaminated somewhere upstream of hundreds of restaurants, pinned by epidemiology, never traced to a farm. It was declared over because the reported illnesses had stopped, not because anyone had found the source. Nobody ever did.

If that were only history I could live with it. It is not. In November 2024, eighty-nine people in fifteen states were infected with E. coli O157:H7 from romaine lettuce. Thirty-six went to the hospital. Seven developed hemolytic uremic syndrome, which is the polite clinical way of saying a child’s kidneys shut down. One person died. On January 15, 2025, CDC and FDA closed the file, recorded the vehicle as romaine from a common supplier, and issued none of the public notice the agencies had issued for every comparable romaine outbreak going back to 2010. I called what I wrote at the time CDC and FDA — Romaine Silent. The names existed the whole time. FDA released its traceback summary with the processor and the grower blacked out under the (b)(4) exemption, and Taylor Farms denied our clients’ claims from behind them. When the agency finally took the boxes off, Taylor Farms of California in Salinas was the sole processor and Anthony Costa & Sons of Soledad the single grower.

Naming is not only about stopping today’s illnesses. In most outbreaks the food is eaten long before anyone knows the source. It is about keeping a ledger, so that a buyer, a school district or a mother in the produce aisle can see which firms keep turning up in the same sad story. When this outbreak began in June, the only assembled ledger for Taco Bell sat on a blog. 

The same ledger exists for Taylor Farms, the supplier at the center of this summer, and it only exists because somebody wrote names in it. CNN assembled it independently this morning and counted at least five outbreaks that health officials have tied to the company over the past decade. The 2013 Cyclospora outbreak traced to salad mix from its Mexico operation. The 2015 celery and onion mix behind E. coli in Costco chicken salad. The 2024 slivered onions in the McDonald’s Quarter Pounder outbreak that sickened more than a hundred people and killed one. The 2024 romaine. And now this one. Four of those five entries are in the record because an agency, a court or a reporter published a name. The romaine entry is there because a lawyer pried it loose eighteen months after a funeral.

That reporting also supplies the piece my own argument has been missing. In an investigation published this morning, Casey Tolan, Yahya Abou-Ghazala, Curt Devine and Kyung Lah of CNN report that in the 2024 McDonald’s onion outbreak — 104 illnesses in fourteen states and one death — a former senior FDA food official described the evidence against the supplier as about as strong as such evidence gets, and said the company worked hard to keep the agency from identifying it publicly, arguing the case was not solid enough. It did not succeed there. Nobody had to make that argument about the romaine, because the agency never named anyone at all. CNN also reports that FDA concluded internally that Taylor Farms had supplied all the romaine available at every point of sale relevant to that outbreak — a finding the public saw only because lawyers for a hospitalized child obtained the agency’s report.

I am quoted in that story, and the point I made to those reporters belongs in this argument. In every one of those outbreaks the company answered by saying its own testing had found nothing. Testing done after people are already sick almost never catches the organism that made them sick, because the product that carried it has been eaten. “People eat the evidence.” A negative result on what is left in the cooler is not a finding of innocence, and it is not a substitute for a name.

That changes the shape of this. Naming is not a decision an agency makes in a quiet room by itself. There is a party on the other side of it, with counsel, pressing for the letter of the alphabet, and it is not always the government’s reticence that wins the day. Note the coincidence in the dates while you are here: in the same twelve months that CDC was calling Taco Bell Restaurant Chain A, the produce industry finished off the federal program that had been sampling fruits and vegetables around the country for pathogens since 2001. CNN reports that trade groups where Taylor Farms executives held leadership positions were among those that objected to it or pushed to have it defunded. Two different ways of not knowing, in the same year.

There is also something concrete on the table. In February, Stop Foodborne Illness filed a citizen petition asking FDA to stop treating a company’s name as confidential commercial information and, failing that, to disclose it anyway under the agency’s own duty to keep food safe. I would ask for one thing more. The petition speaks of the consumer-facing company, and in the 2024 romaine outbreak there was no such thing: no brand name appeared on that lettuce anywhere. Disclosure has to reach the processor and the grower too or produce outbreaks will keep ending in gray boxes for the simple reason that nobody’s brand was on the bag.

The July 16, 2026 advisory proves the point I have been making since 2011. No statute ever prevented CDC from naming Taco Bell in 2012, and by the agency’s own admission there was no rule at all — only precedent. Naming is a choice, it was always a choice, and this time the agencies made the better one, in the middle of an open investigation, and the republic survived. Withhold the name and every outbreak arrives looking like the first one anybody has ever had.

The petition’s lead example is the 2024 romaine outbreak, and the child it describes is my client. He was nine years old. Eighteen days in the hospital, nine of them on continuous dialysis and five more on intermittent, five transfusions, a nephrologist he is still seeing. His father spent months trying to learn the name of the company that sold the lettuce that did that to his son. He should have been able to read it in a government notice in January 2025, in plain text, with no gray boxes at all.