Today I fly to New Orleans for IAFP 2026, the annual meeting of the International Association for Food Protection, July 26 through 29 at the Ernest N. Morial Convention Center. It is the largest food safety conference in the world — thousands of microbiologists, regulators, quality assurance directors and academics from more than sixty countries. I am going with one message, and it is about Cyclospora.

Start with the numbers. CDC’s surveillance page, now updated weekly, counted 4,173 laboratory-confirmed domestically acquired cases as of July 21, across 41 states, with 308 hospitalizations. CDC is aware of more than 7,400 additional cases that are not yet laboratory confirmed, most of them from Michigan and Ohio, which puts the national figure above 11,500. The median illness onset is June 26. CDC assumes a six-week reporting lag between onset and reporting, so every one of those numbers is going to grow.

Now the comparison. Over the comparable window last year — May 1 through mid-July — CDC recorded 249 domestically acquired cases. For all of 2025 it had 1,180, with 105 hospitalizations. For all of 2021 it had 1,024. Counting every reported case, including travel-associated illness, CDC’s full-year totals were 2,707 in 2022, 4,200 in 2023, 3,719 in 2024 and 3,955 in 2025. This year’s laboratory-confirmed total, domestic plus travel, was already about 4,940 on July 21. We passed a normal full year in early July with the season still running. Michigan alone has reported 8,176 cases and 160 hospitalizations. Michigan normally sees about fifty a year.

The nine-state outbreak that CDC and FDA have named — the Taco Bell cluster traced to Taylor Farms de Mexico shredded iceberg — accounts for 1,947 of those illnesses and 98 hospitalizations. Add up what the fifty states are reporting on their own dashboards tonight and the floor is somewhere near 14,800. The named recall does not describe the outbreak.

There will be a great deal of good science presented in New Orleans this week on interventions, wash-water chemistry, sanitizer efficacy and process validation. Here is what I have found the published science says about Cyclospora.

Washing does not do it. Ortega and Sanchez wrote in Clinical Microbiology Reviews that washing and sanitizing may reduce but would not be expected to eliminate the risk, and that these practices have been demonstrated not to completely remove oocysts from contaminated produce. The best consumer-level data is a 2021 study in Foods that contaminated raspberries and blueberries with three parasites and washed them three ways. A minute under cold running water removed at least eighty percent of the other two parasites. For Cyclospora on raspberries it removed thirty-nine percent. A vinegar soak or a salad spinner brought that to roughly eighty-five percent. Nothing removed all of it. These oocysts are stickier than Cryptosporidium and Giardia.

Chlorine does not do it, and that is not my opinion. It is FDA’s, in a fact sheet the agency wrote for farmers: chlorine and other common anti-microbial chemical treatments are not effective against C. cayetanensis. The field evidence is thirty years old. In Pokhara, Nepal, an outbreak among British soldiers was traced to drinking water that was chlorinated and filtered and carried a normal residual, and the parasite came through anyway (Rabold, Lancet, 1994). Gaseous chlorine dioxide at 4.1 milligrams per liter for twenty minutes produced no reduction in sporulation at all.

Municipal wastewater treatment is no guarantee. FDA’s own language is that treatment may render the parasite inactive, that conflicting evidence suggests it may remain viable after treatment, and that little conclusive data exists either way. What we do have is this. Cyclospora was detected in wastewater in 1998. Charles Gerba’s group sampled two Arizona treatment plants monthly for a year and concluded that conventional treatment’s ability to remove oocysts is limited. A two-year study in southeastern Georgia found the parasite confirmed by sequencing in nine percent of municipal wastewater sludge samples. Conventional treatment was never designed against this organism and has never been validated against it. That is the accurate sentence, and it is bad enough.

There is no validated kill step for Cyclospora on ready-to-eat produce. The parasite cannot be grown in culture. Heat works — seventy degrees Celsius for fifteen minutes prevents sporulation — and heat also destroys lettuce and raspberries. Every control this industry has built for leafy greens points at bacteria and ends in a chemical intervention. This parasite swims through it. Cyclospora has one reservoir and it is the human gut. When it turns up on lettuce, human feces reached that lettuce or the water that grew it. Nothing that happens after harvest changes that.

A retired FDA food safety director said the quiet part out loud this week. Mark Moorman, until recently the director of FDA’s Office of Food Safety, told CNN that investigators have never definitively identified the cause of a Cyclospora outbreak. Not one, in thirty years. Asked whether anyone is obliged to look, he was blunt: no law or rule requires a farm to test its irrigation water or its produce for this parasite. It is voluntary, and he said FDA does not have that lever. He suggested the big buyers could pull it — he named Kroger, Food Lion and Costco — and that Congress could write the requirement and fund the research. In the same piece Jennifer McEntire, the microbiologist, put the mechanism plainly. “Water is number one,” she said, and the open question is how human waste gets into it. Her candidates are the ones you would expect. Waste emptied from portable toilets. A septic tank that leaked. A sewer that overflowed after heavy rain.

One disclosure before the next paragraph. My firm represents people sickened in this outbreak, and we have filed cases naming Taylor Farms entities as defendants. The record below is public either way. You should still know where I sit.

And the 2013 investigation found something worth sitting with. Goodman reports a detail from FDA’s investigation of the 2013 Cyclospora outbreak traced to salad mix from Taylor Farms de Mexico: when investigators pulled the medical records of harvesting workers, they found antidiarrheal medications and the combination antibiotic used to treat cyclosporiasis. No diagnoses were recorded in the records FDA inspected, and those drugs are prescribed for other things, so it proves nothing on its own. But the plant is at Doctor Mora, in Guanajuato — the same facility at the center of this summer’s outbreak. And roughly eight hundred feet from that processing building sits Balneario Las Fajanas, a public thermal-water bathing complex with pools, slides, showers and changing rooms, open every day of the year and listed by the state of Guanajuato’s own tourism office. Google Earth imagery shows it built and operating in March 2010, more than three years before FDA and COFEPRIS conducted their environmental assessment at the plant. That published assessment covers the processing facility and five ranches. Its second recommendation told the firm to determine whether Cyclospora is a reasonably likely hazard in that growing region and, if so, to re-evaluate the wash step. Thirteen years later, no one has produced a document showing that determination was ever made — and the whole of this post is the reason the wash step was never going to be the answer.

None of this is news to the government, or to the industry. In 2021 FDA released a Cyclospora Prevention, Response and Research Action Plan, written by a task force the agency created in 2019. In 2023 the National Advisory Committee on Microbiological Criteria for Foods delivered FDA a full report on Cyclospora cayetanensis in produce, with sections on preventive measures, surrogates, the maintenance and conveyance of wastewater, and prevention in food. That report states that the oocysts are resistant to many of the common chemical treatments used against bacterial pathogens in the produce production environment and in agricultural inputs, agricultural water among them. Its subcommittee was co-chaired by Peggy Cook and by Max Teplitski, now the chief science officer of the International Fresh Produce Association. None of the science in this post is contested. It has been sitting in a federal advisory committee report for three years.

Which is why the fix is upstream, and it is not mysterious. Treat the water. FDA says so in the same fact sheet: in regions where cyclosporiasis is endemic, microfiltration, ozone or ultraviolet treatment may be necessary to decrease the parasite in irrigation water. Read the footnote listing which regions those are and you find a roster running from Bangladesh to Zimbabwe with Puerto Rico sitting in the middle of it. The data behind the interventions is real, with one caveat that matters: because the parasite cannot be propagated in a laboratory, most of this work uses a poultry coccidian, Eimeria acervulina, as a surrogate. Ozonated water acidified with citric acid inactivated ninety-three percent of sporulation in that surrogate. Ultraviolet light at 222, 254 and 282 nanometers each cut sporulation and produced close to a three-log reduction in its infectivity. Zero-valent iron sand filtration — tested on actual C. cayetanensis oocysts rather than a stand-in — retained ninety-seven percent of them.

Water treatment is already mandatory. It is just aimed at the wrong organism. The California and Arizona Leafy Greens Marketing Agreements, which cover better than ninety percent of the leafy greens grown in this country, require growers who use surface water for overhead irrigation to treat that water in the twenty-one days before harvest. Then read what the requirement asks for. An EPA-registered antimicrobial, validated and verified, with success measured by generic E. coli. That is chlorine-family chemistry, selected for bacteria and scored by a bacterial indicator — the exact chemistry FDA says does not work on this parasite. The mandate exists and it points at the wrong organism. Microfiltration, ozone and ultraviolet are required of no one. And the field at the center of this outbreak is in Guanajuato, which no LGMA metric reaches at all.

Test for the right thing. FDA states plainly that testing for generic E. coli and fecal coliforms will not identify C. cayetanensis. Human-specific markers will. That same Georgia study found the human fecal marker HF183 in thirty-three percent of irrigation pond samples. If your irrigation water carries a human sewage signal, you have a Cyclospora exposure whether or not anyone ever finds an oocyst. The Center for Produce Safety has spent more than $1.6 million since 2014 establishing that this parasite is endemic in the United States and recoverable from wastewater and irrigation water, and it published a Cyclospora resource page this week collecting the literature on agricultural water monitoring and mitigation. The industry funded the finding. It needs to act on it.

Write the parasite into the rule that already exists. The pre-harvest agricultural water rule became final on May 6, 2024 and requires covered farms to conduct an annual systems-based assessment of their water — the system, the practices, the crop, the environment, and adjacent land uses including sewage. The only numeric microbial criterion in Subpart E is generic E. coli, the same indicator FDA says will not identify this parasite. For leafy greens and berries the rule should name Cyclospora outright, and the Foreign Supplier Verification Program should require importers to document treatment that works on protozoa rather than chlorination that does not.

Fix field sanitation. OSHA’s standard has required agricultural employers to provide one toilet and one handwashing station for every twenty hand laborers, within a quarter mile, since 1987. Operations with fewer than eleven workers are exempt outright. Inspectors are thin on the ground. Workers paid by the piece and worried about their immigration status do not file complaints. For an organism whose only reservoir is a human being, that exemption is the hazard.

And count it, trace it and test for it. Cyclospora came out of FoodNet last July. The Food Traceability Rule that would have put lot-level records in FDA’s hands within twenty-four hours was supposed to be in force this January and now cannot be enforced before July 2028. The methods to watch for this parasite in wastewater have been published for more than a decade. CDC built a National Wastewater Surveillance Systemthat takes data from about fifteen hundred sites and covers roughly half the country. It reports SARS-CoV-2, influenza A, RSV, mpox and measles. Cyclospora is not among its targets, and it is not on the academic WastewaterSCAN panel either. Meanwhile a diagnostics company watching its own clinical panels reported national positivity jumping from one or two percent to ten or twelve this spring. Frank Yiannas, who ran FDA’s foods program under two administrations and is a past president of this association, told POLITICO this week that the federal response is approaching a catastrophic level of mismanagement and should get an independent review. He has been proposing an NTSB-style board for foodborne outbreaks since last November. Restore the Microbiological Data Program, which for eleven years pulled high-risk produce off the shelf and tested it, and which the industry lobbied to death in 2012.

A tip of the pen. The Moorman and McEntire interviews and that 2013 record are Brenda Goodman’s reporting for CNN. She has been on this story for weeks. It was also her July 20 piece that carried Frank Yiannas on the withdrawn laboratory result — he called it unfortunate and consequential, warned that consumers would wrongly read a false positive as proof the recall was unnecessary, credited FDA for disclosing the error promptly, and then said the thing that matters: “transparency alone is not enough.” The agency still owes the public a root cause for the laboratory failure and the corrective actions that follow from it. Goodman went and asked the people who actually ran these investigations the one question the trade press has spent a month stepping around — how does human waste get into the water in the first place — and got them to answer on the record. It is the piece I wish had run three weeks ago.

See you in the “Big Easy.” I will be in New Orleans Sunday through Wednesday. If the honest sentence is that we cannot make contaminated lettuce safe, then the whole of the answer is keeping it from being contaminated — and what we require today is aimed at a different organism.

CDC currently reports 4,173 laboratory-confirmed, domestically acquired Cyclospora cases since May 1.[1] The federal government’s own published model for foodborne illness burden — Scallan and colleagues, 2011, still the only Cyclospora-specific burden estimate ever published in this country that I could find — carries a credible interval whose upper bound implies that roughly 272 people are infected for every 1 a laboratory confirms.[2] Multiply it out and this outbreak has infected at least 1,135,056 Americans.

I do not believe that number, and I would not publish it as a finding. The top of an interval is not an estimate; it is the edge of what the model cannot rule out, and in this case the model is fifteen years old and the interval is enormous — the same table’s lower bound implies a multiplier of 1.0, which would mean every single Cyclospora infection in America gets laboratory-confirmed, which is plainly false. When the honest range on a parameter runs from 1 to 272, the honest thing to say is that we are guessing.

Scallan’s central estimate for the underdiagnosis multiplier is 83.1. Applied to 4,173 laboratory-confirmed cases, that is 346,776 people. That figure is not the edge of anything. It is the middle of the published distribution, produced by CDC’s own epidemiologists and used by CDC ever since to describe how much foodborne illness this country actually has.[3]

Walk it down, because even 346,776 is built on generous assumptions. The 83.1 was derived from data collected in the 2000s, when finding this parasite required a clinician to specifically request an unusual stain because the routine ova-and-parasite exam misses it entirely.[4] The first FDA-cleared molecular gastrointestinal panel with a Cyclospora target did not exist until 2014, and by 2018 and 2019 a survey of roughly seven hundred American clinical laboratories found 62 percent of panels included one.[5] Detection is far better now than when that multiplier was built. On top of that, an outbreak this size creates its own surge — physicians in Michigan and Ohio are testing for this parasite in July of 2026 in a way nobody does in an ordinary March. Both effects push the real multiplier down.

There is one more number that belongs on the table because it does not come from the government. bioMérieux, which makes the most widely used molecular gastrointestinal panel in the country, publishes surveillance drawn from its own installed base of instruments, and between June 26 and July 5 of this year it recorded Cyclospora detections running 10.8 percent above the same stretch of 2025 nationally, and 27.5 percent above it across the Midwest.[6] Those are not the numbers you would expect underneath a national count running many times last year’s at the same point in the season.[7] I think the window explains most of the gap — that stretch closes before this outbreak turned steep, and Michigan’s newly reported cases over the four weeks that followed ran 71, then 498, then 1,331, then 2,408 — and the platform sees only the laboratories that bought one manufacturer’s machine. 

Hospitalizations are the least-undercounted thing in any outbreak. People sick enough to be admitted get tested. Scallan’s companion table put roughly 20 Cyclospora hospitalizations a year against 19,808 total annual illnesses — a hospitalization rate of about one tenth of one percent of all infections, not of confirmed cases.[8] There are 308 hospitalizations in the national count. Divide 308 by 0.001 and the implied number of infections is roughly 305,000.

What the hospitalization figure actually tests is whether this outbreak looks like the outbreaks the model was built from, and it does: Scallan’s table implies roughly 8.4 hospitalizations for every hundred laboratory-confirmed cases, and this outbreak is running 7.4. A model assembled from 2000s data is describing a 2026 illness with about the severity it predicted, which is exactly what you would want to check before applying a fifteen-year-old model at all. 

Now cut it to the bone. Suppose the multiplier has fallen by a full order of magnitude since 2011 — from 83.1 down to 8.3. That is a more aggressive haircut than the arrival of PCR panels plausibly justifies, and it concedes essentially the entire argument to anyone who wants to say the old number is stale. It still puts this outbreak at about 35,000 people. That is more than twice what every state health department in America has managed to count between them, and it is roughly ten times the number of cyclosporiasis cases this country reports in a normal full year.[9]

Whatever you believe about the multiplier, every rung of that ladder sits above what is being counted. The disagreement is only about how far above.

Michigan offers a check on all of it. The state has reported 8,176 cases and 160 hospitalizations.[10] That is a hospitalization rate of 2.0 percent against the 6.5 percent Scallan found — though the comparison is not quite like for like, because Michigan’s total includes probable cases while Scallan’s rate was calculated among laboratory-confirmed ones, which pushes Michigan’s true rate somewhat higher than 2.0. Even allowing for that, the direction is unmistakable. A falling hospitalization rate means a state is catching the mild end of the illness spectrum, which means Michigan’s own undercount multiplier is far smaller than 83. Michigan is looking hard. Run the hospitalization arithmetic on that one state anyway and you get roughly 158,000 infections, which works out to a multiplier of about 19. That is the number I would defend. And then consider Pennsylvania, which has reported 28 cases in a nine-state outbreak and where reporting cyclosporiasis to the health department is voluntary. Nobody can calculate Pennsylvania’s multiplier, because Pennsylvania is not measuring anything.[11] That is the actual shape of the undercount: small where somebody is looking, unknowable where nobody is.

Against every one of those figures, here is what is actually counted. CDC’s outbreak investigation — laboratory confirmation plus a documented exposure — stands at 1,947 people in nine states, 98 hospitalized.[12] CDC’s national surveillance count of laboratory-confirmed domestic cases is 4,173, with more than 7,400 additional reported illnesses awaiting the analysis that would confirm them, upward of 11,500 cases in all across 41 states, and 308 hospitalizations. Add up what the individual state health departments have posted and the floor is near 15,500.[13] Every one of those is a floor, and every one of them describes a week ago or more, because CDC has said it can take as long as six weeks to determine whether a sick person belongs to an outbreak.

It is worth pausing on how large those floors already are. CDC’s outbreak reporting system holds 181 Cyclospora outbreak records covering 1990 through 2023 — thirty-three years — and together they account for 6,251 illnesses.[14] The 11,500 reported this summer is nearly twice the entire outbreak-associated total that system logged in three decades. The outbreak that taught this country the parasite existed, the 1996 Guatemalan raspberry outbreak, produced 1,465 reported cases and 978 laboratory-confirmed ones across twenty states, the District of Columbia and two Canadian provinces, and it is the reason cyclosporiasis became a nationally notifiable disease in 1999.[15] The confirmed cluster alone in this outbreak is larger than that.

The last question is why a plaintiffs’ lawyer (and his Epi and Nurse) is doing this arithmetic at all, and the answer is that nobody with a federal badge is. There has been no updated Cyclospora burden estimate since 2011. The 2025 revision of the federal foodborne illness estimates covers seven pathogens and this one is not among them.[16] And on July 1 of 2025, CDC narrowed FoodNet — the active surveillance system that generated the 239-cases-a-year denominator underneath every figure above — from eight pathogens to two, keeping Salmonella and Shiga toxin-producing E. coli and dropping Cyclospora, Campylobacter, Listeria, Shigella, Vibrio and Yersinia, citing inadequate funding.[17] Ten months later the first people in this outbreak got sick.

The realistic range in this post runs from 35,000 to 347,000. It is embarrassingly wide, and that width is not my doing. It is the width you get when a country decides that counting sick people is a discretionary expense. There may be a final official number for this outbreak eventually. It will be tidy, it will be footnoted, and it will be smaller than the truth.

[1]CDC, Cyclosporiasis Surveillance, cdc.gov/cyclosporiasis/php/surveillance/index.html (4,173 laboratory-confirmed domestically acquired cases; 7,400+ awaiting analysis; 11,500+ total; 41 states; 308 hospitalizations; data as of July 21, 2026).

[2]Scallan E, Hoekstra RM, Angulo FJ, Tauxe RV, Widdowson MA, Roy SL, Jones JL, Griffin PM. Foodborne Illness Acquired in the United States — Major Pathogens. Emerg Infect Dis. 2011;17(1):7–15, Table 2. doi:10.3201/eid1701.p11101. The Cyclospora cayetanensis row reports 239 laboratory-confirmed cases annually and 19,808 estimated total illnesses, 90% credible interval 239–65,135 — implying a multiplier ranging from 1.0 to approximately 272.5. Expanded tables at cdc.gov/foodborneburden/pdfs/major-pathogens-expanded-tables.pdf.

[3]Id. (underreporting multiplier 1.0; underdiagnosis multiplier 83.1; 11,407 domestically acquired foodborne illnesses, 90% CrI 137–37,673). The domestically acquired foodborne interval is a 275-fold spread and should not be presented as precise.

[4]Mathison BA, Pritt BS. Cyclosporiasis — Updates on Clinical Presentation, Pathology, Clinical Diagnosis, and Treatment. Microorganisms. 2021;9(9):1863. doi:10.3390/microorganisms9091863. See also American Society for Microbiology guidance that a normal ova-and-parasite examination does not rule out Cyclospora, and CDC guidance recommending three or more stool specimens collected more than 24 hours apart owing to intermittent shedding.

[5]Evaluating Foodborne Cyclosporiasis Using Foodborne Diseases Active Surveillance Network and Foodborne Disease Outbreak Surveillance System Data, 2015–2019. Am J Trop Med Hyg. 2025;112(2):319 (1,376 FoodNet cases; 21.1% travel-associated; 90.9% summer onset; 71.7% outbreak-associated). The 62 percent figure appears in that paper, which cites an underlying survey of approximately 700 U.S. diagnostic laboratories; it is not the authors’ own finding.

[6]bioMérieux, Tracking the Cyclospora cayetanensis Outbreak in the United States (July 2026), reporting BIOFIRE FIREWORKS surveillance data drawn from its installed base. The same post states that several FDA-cleared multiplex panels available for clinical diagnostic testing do not include Cyclospora as a target.

[7]CDC Health Alert Network Advisory No. 00531, Domestically Acquired Cyclosporiasis Cases in Multiple U.S. States, 2026 (July 14, 2026) (249 cases reported nationally May 1–July 16, 2025). The 2026 and 2025 reporting windows are not precisely aligned.

[8]Scallan et al., supra note 2, Table 3 (approximately 20 Cyclospora hospitalizations annually, 90% CrI 0–190; 6.5% hospitalization rate; zero deaths). CDC’s expanded tables note that hospitalization and death rates were doubled to adjust for underdiagnosis before being applied to the number of laboratory-confirmed cases — so the hospitalization estimate does not run through the 83.1 underdiagnosis multiplier, while the illness estimate does. Twenty hospitalizations against 19,808 estimated illnesses yields approximately 0.101% of all infections. The upper bound of 190 hospitalizations would imply 0.96%, and a correspondingly smaller total near 32,000.

[9]CDC cumulative reported cases through report week 53: 2,707 (2022); 4,200 (2023); 3,719 (2024); 3,955 (2025) — an average of roughly 3,645 per year, inclusive of travel-associated cases.

[10]Michigan Department of Health and Human Services, reported case total as of July 24, 2026; hospitalizations as of July 23, 2026. The state total includes probable as well as laboratory-confirmed cases.

[11]Casillas SM, Hall RL, Herwaldt BL. Cyclosporiasis Surveillance — United States, 2011–2015. MMWR Surveill Summ. 2019;68(SS-3):1–16. doi:10.15585/mmwr.ss6803a1 (cyclosporiasis not reportable in Alabama, Idaho, Maine, Mississippi, Nevada, North Dakota or Pennsylvania during the surveillance period; reporting to CDC voluntary even where the condition is reportable by law).

[12]CDC, Cyclosporiasis Outbreak Investigation, cdc.gov/cyclosporiasis/outbreaks/07-26/investigation.html, and Where People Got Sick, cdc.gov/cyclosporiasis/outbreaks/07-26/locations.html (nine states; at least 1,947 cases; at least 98 hospitalizations; no deaths).

[13]State-by-state totals compiled from individual state health department postings; see also CNN’s running case tracker, cnn.com/2026/07/21/health/cyclospora-cases-count (refreshed July 24, 2026). Michigan and Ohio figures per MDHHS and CNN, July 24, 2026; NBC News reported 2,596 Ohio cases the same day and the Ohio Department of Health has not posted the figure itself.

[14]CDC National Outbreak Reporting System public data file, 181 Cyclospora outbreak records covering 1990 through 2023, totaling 6,251 illnesses and 198 hospitalizations.

[15]Herwaldt BL, Ackers ML; Cyclospora Working Group. An outbreak in 1996 of cyclosporiasis associated with imported raspberries. N Engl J Med. 1997;336(22):1548–56 (1,465 cases reported by 20 states, the District of Columbia and 2 provinces; 978 laboratory-confirmed). Cyclosporiasis became nationally notifiable in 1999.

[16]Scallan Walter EJ, et al. Foodborne Illness Acquired in the United States — Major Pathogens, 2019. Emerg Infect Dis. 2025;31(4). Cyclosporais not among the seven pathogens re-estimated.

[17]CDC reduced FoodNet’s pathogen panel to Salmonella and Shiga toxin-producing E. coli effective July 1, 2025. The CDC quietly scaled back a surveillance program for foodborne illnesses, NBC News (Aug. 26, 2025), nbcnews.com/health/health-news/cdc-quietly-scaled-back-surveillance-program-foodborne-illnesses-rcna227089; CDC confirms cuts to program that tracks foodborne pathogens, Food Safety News (Aug. 2025) (quoting CDC spokesman Gabrial Alvarado). CDC told the Connecticut Department of Public Health that funding had not kept pace with the resources required to maintain FoodNet surveillance for all eight pathogens.

SSaturday, July 25, 2026

Last Saturday this column was called The Source Finally Got a Name — and Then FDA Found It on Lettuce That Was Never Recalled. This week the government caught up — to the Washington Post, to the Wall Street Journal, to state health departments that had already published what the federal pages would not. And when CDC finally moved its outbreak page on Friday, the outbreak got six weeks shorter. Here’s what moved.

The Secretary said it was under control on Tuesday. At a health care fraud briefing on July 21, Secretary Kennedy said the administration has the outbreak “under control,” that epidemiological forensics had identified the source, and that the companies involved had recalled. In the seventy-two hours that followed, Michigan went from 7,171 cases to 8,176 and from 102 hospitalizations to 160, CDC added four states to the outbreak, and FDA opened another Cyclospora investigation with no product named.

The counting gap is now CDC’s own argument. Add up every state that publishes a number and the floor is roughly 14,800. CDC’s surveillance page carries 4,173 lab-confirmed domestic cases, more than 7,400 awaiting analysis and 308 hospitalizations, against 249 cases at this point last year. That page now states that CDC’s updates exclude probable cases, that state figures run higher because states include them, and that a roughly six-week reporting lag means the counts keep climbing. That is not a critic’s characterization of the numbers. It is the agency’s.

The Post named the ninth state before CDC did. Friday morning Lena H. Sun reported that CDC had linked Illinois, Kansas, Oklahoma and Pennsylvania to the Taco Bell outbreak, while CDC’s own page still said five states. Kansas and Oklahoma had already said so themselves. Hours later the agencies caught up: 1,947 cases in nine states, 98 hospitalizations, no deaths. Note the arithmetic — adding four states raised the outbreak count by 303 and the hospitalizations by four, while those same four states report about 900 cases of their own. I wrote about that Friday.

And the outbreak got six weeks shorter. The official onset range had been May 13 through July 13. It is now June 22 through July 20, and FDA’s new nine-state page carries both dates on the same screen. On the same day four states came into the outbreak, roughly six weeks of illness went out of it.

Three things arrived with that page. The distribution list grew from 27 states to 28, and the single addition is West Virginia — the outbreak state I kept flagging as missing from the company’s own list. FDA broke retail out from foodservice for the first time: Marketside product went to Walmart stores in fifteen states, and of the nine outbreak states only Indiana, Kansas, Kentucky, Oklahoma and West Virginia appear, meaning the two hardest-hit states got this lettuce through foodservice. And a new international distribution heading discloses that recalled product was sold to consumers in Mexico — a day after Mexico’s health ministry announced its own plant sampling came back negative.

Then Friday night, the Journal. Taylor Farms called the White House to ask that the recall announcement be delayed, arguing the government had no positive laboratory test and was overstating the company’s culpability. The call was arranged by Trent Morse, a lobbyist for the company and a former senior White House personnel official. The next part matters as much as the first: the White House went back to FDA separately, asked how the traceback had been done, reviewed how the agency planned to tell the public, was persuaded, and gave FDA the green light. The same story answers a question I had been asking for a week — FDA did not name Taylor Farms on July 16 because of legal restrictions around trade secrets, which is why the advisory referred only to a single unnamed supplier. My firm represents people sickened in this outbreak and has sued Taylor Farms entities.

The President was asked about lettuce for the first time on Friday. Peter Doocy asked when it would be safe to eat lettuce again, and the answer was “I don’t know, I haven’t thought about it,” followed by a promise of a major tariff on Mexico over the lettuce. Taylor Farms is a California company headquartered in Salinas; the lettuce was shredded at its own plant at Doctor Mora in Guanajuato. A tariff does not test irrigation water, inspect a field, trace a lot code or count a sick person. It is not a food safety measure.

All of it is being run by acting officials. FDA has no confirmed Commissioner; Kyle Diamantas has been acting since May 12. CDC has no confirmed Director; Jay Bhattacharya has been performing the duties since February while also running NIH, and I have not been able to find a public statement from him about this outbreak. The nominee, Dr. Erica Schwartz, had her Senate hearing on July 15 and still awaits a vote. Klobuchar, Stanton and Ossoff all wrote with questions, two of them with deadlines. I am not aware of a substantive answer to any of the three.

And it may not all be lettuce. Kari Irvin, deputy director of FDA’s Coordinated Outbreak Response and Evaluation Network, said Friday that “We have multiple investigations of cyclospora open,” and that preliminary work on North Carolina’s 561 cases points toward parsley and cilantro rather than lettuce. North Carolina’s own read is multiple vehicles, not one product from one company. One recall did not close this.

Nineteen million eggs, and seven months of sick people. CDC posted 98 Salmonella Enteritidis illnesses in 17 states, 26 hospitalized, with onsets from November 21, 2025 to June 30, 2026. Midwest Poultry Services recalled 1,589,577 dozen shell eggs out of two Texas farms. I wrote that one up Friday — and got back a correction worth more than the post. Dr. Eric Gingerich, a poultry veterinarian in Zionsville, Indiana, wrote to tell me that American producers vaccinate their layers extensively, and that Britain’s Lion Code is an industry scheme rather than a government mandate. He is right on both counts. USDA’s own survey of 328 table-egg farms found 99 percent vaccinating, on close to the protocol he described. I have corrected the post and I am grateful for the letter. What survives the correction is the interval: we vaccinate the hens, swab the house twice in a laying hen’s life, send an inspector every three to five years, and nobody pulled a carton for seven months.

The federal table went from fourteen investigations to sixteen. Ten of the sixteen on FDA’s outbreak table have nothing in the product column, up from eight last week — including a brand-new SalmonellaJaviana investigation at 106 cases, an Oranienburg cluster up from 69 to 81, an Enteritidis cluster up from 91 to 96, and another Cyclospora investigation at 72. Both moringa leaf powder investigations ended. The table has not been updated since Wednesday, so the row for the lettuce outbreak still points at the advisory FDA superseded on Friday. Meanwhile the frozen blueberry E. coli O145:H28 outbreak, the soft cheese Listeriaoutbreak and the infant botulism outbreak — four babies, all hospitalized — all remain open. I represent families in those cases. On the recall side, Maple Leaf Foods pulled about 12,036 pounds of not-ready-to-eat smoked bacon imported from Canada without import reinspection, and Phyllis Entis has the full roundup.

I am headed to New Orleans. IAFP 2026 opens tomorrow at the Ernest N. Morial Convention Center and runs through Wednesday. It convenes while the largest cyclosporiasis outbreak in American history is still being counted, by nine different methods, in nine different states. If you are there, find me.

The answer to “when will it be safe to eat lettuce again” is not a tariff. It is three things, and all three are sitting there waiting.

  1. Restore the Microbiological Data Program, which for eleven years pulled high-risk produce off the shelf and tested it, and which the industry lobbied to death in 2012.
  2. Put the Food Traceability Rule into force. Its compliance date was January 20, 2026 — four months before the first person in this outbreak got sick — and it now sits pushed to July 20, 2028.
  3. Put Cyclospora back into FoodNet. Reporting had been mandatory since 1997; on July 1, 2025 FoodNet dropped six of its eight pathogens.

That’s the week — four states added to an outbreak that got six weeks shorter, a recall the company tried to slow down, nineteen million eggs seven months late, a federal table with ten investigations and nothing in the product column, and one veterinarian who took the time to tell me I had it wrong. Check back next Saturday.

About Bill Marler

William “Bill” Marler has spent more than thirty years as a food safety lawyer and advocate—work that began with the 1993 Jack in the Box E. coli outbreak and has never really stopped since. In the years that followed, he has represented victims in nearly every major foodborne illness outbreak in the United States. That case, and the movement it launched, is the subject of the book “Poisoned” and the Emmy Award–winning Netflix documentary of the same name. Bill’s work has been profiled in The New Yorker (“A Bug in the System”), the Seattle Times (“30 years after the deadly E. coli outbreak, a Seattle attorney still fights for food safety”), the Washington Post (“He helped make burgers safer. Now he’s fighting food poisoning again”), and many others.

Dozens of times a year, Bill speaks to industry, regulators, and universities across the United States, Canada, Europe, Africa, China, and Australia about a simple idea: outbreaks are preventable. He has testified before Congress on the Food Safety Modernization Act and teaches food safety at institutions including the Harvard T.H. Chan School of Public Health. He writes regularly about food litigation and food safety at Marler Blog, and in 2009 he founded Food Safety News, which he continues to publish.

Corrected July 25, 2026. An earlier version of this post said that the United States does not vaccinate laying hens and that the British government requires vaccination. Both were wrong. Dr. Eric Gingerich, a poultry veterinarian in Zionsville, Indiana, wrote to tell me so, and the record backs him up on both counts. The title, the last three paragraphs and the closing line have been rewritten. My thanks to him.

Ninety-eight people in 17 states. Twenty-six in the hospital. CDC’s outbreak page went up yesterday, and the illness onsets run from November 21, 2025 to June 30, 2026. Seven months of sick people before a carton came off a shelf.

Midwest Poultry Services recalled 1,589,577 dozen shell eggs on July 22 — 19 million eggs — out of two Texas farms, sold as Kroger, Simple Truth, Brookshire’s, Cal-Maine and Country Morning. FDA says laboratory, epidemiologic and traceback data point at those eggs, and it is still looking for others. Farm environmental samples matched the outbreak strain by whole genome sequencing.

Americans used to drink these on purpose. Rocky cracked five into a glass in 1976 and Stallone actually swallowed them. Vince Gironda, the Iron Guru who trained Schwarzenegger, sold raw eggs as recovery food. Fighters drank them because it beat cooking. Then the gyms quit, in the late 1980s, on the sound theory that a fighter dehydrated on a bathroom floor does not make weight. The protein math was wrong anyway — a raw egg surrenders about half its protein, a cooked one about ninety percent. The trainers figured it out before the regulators did.

What scared them had a name, and she paid for it. In December 1988 Edwina Currie, a junior health minister in Britain, said “Most of the egg production in this country, sadly, is now affected with salmonella.” Egg sales collapsed overnight. Two million hens went to slaughter, the farmers came for her, and she was gone in two weeks — the woman who wrecked an industry with one sentence.

She was right. A Whitehall report written months after she resigned and buried until 2001 found Britain in the middle of a Salmonella epidemic of considerable proportions. By her own account: 500 people a week sick enough for a hospital bed, some on dialysis, about 60 dead that year.

Then Britain vaccinated the hens — though not by law, which is the part I got wrong. The British Lion Code, 1998, is an industry scheme run by the British Egg Industry Council, and the Lion mark is a registered trademark its subscribers may use only on eggs produced to the code. To carry it: Salmonella vaccination of laying flocks against both Enteritidis and Typhimurium, hygiene and temperature controls, testing of flocks and of eggs beyond what the National Control Programme requires, traceability back to the farm, a date stamped on the shell, and independent unannounced audits. It covers more than 90 percent of British eggs. The government sets the floor. The industry built the rest. In October 2017 the Food Standards Agency took down its own thirty-year warning and told pregnant women, babies and the elderly that Lion eggs were safe raw.

Not a clean win, and I won’t sell it as one. The Bureau of Investigative Journalism found at least 100 cases over the three years after that announcement. FSA’s own risk profile shows farm detections climbing since 2017 and one stubborn Enteritidis cluster that reached 109 cases, most of them people who had eaten Lion eggs. England booked 10,406 salmonellosis cases in 2025, its worst in a decade — though Enteritidis, the serovar the Lion Code vaccinates against, went the other way, from 3,166 reports in 2024 to 3,104 in 2025. FSA weighed all of it and left the advice standing. Vaccination did not eradicate anything. It bought a reduction deep enough, and durable enough, that a government could stop warning mothers off soft-boiled eggs and hold that line when the numbers were checked again.

Now ours. Four agencies touch eggs, which is why nobody can answer this question at a dinner party. USDA’s FSIS has egg products — liquid, frozen, dried — continuous inspection, mandatory pasteurization. USDA’s AMS grades shell eggs and screens out the cracked and the dirty. USDA’s APHIS certifies hatcheries. The carton in your refrigerator belongs to FDA.

FDA’s Egg Safety Rule has been on the books since 2009. Producers with 3,000 or more hens, eggs not pasteurized: buy pullets from monitored suppliers, keep a biosecurity plan, control the rodents, disinfect after a positive, swab the house at 40 to 45 weeks and again after a molt, test the eggs if the swab comes back hot, refrigerate at 45°F starting 36 hours after lay. FDA figured it would cut egg-borne SE illness by about 60 percent, and prevent about 30 deaths a year. The farms see an inspector every three to five years We vaccinate the hens.

Twice. A laying house gets swabbed twice in a flock’s productive life, and the farm gets a visitor once or twice a decade. Midwest Poultry says its own monitoring is what caught this. Ninety-eight people got there first.

Here is what the rule has produced. Every multistate Salmonella outbreak traced to American shell eggs since FDA wrote it:

  • 2010 — Wright County Egg and Hillandale Farms, Iowa. S. Enteritidis. CDC counted 3,578 illnesses between May 1 and November 30 against a baseline of about 1,639 — roughly 1,939 illnesses likely tied to the outbreak. Half a billion eggs recalled, still the largest shell egg recall in American history.
  • 2015 and 2016 — Good Earth Egg Company, Bonne Terre, Missouri. S. Oranienburg, twice, the same strain both times. Fifty-two sick in six states, then eight sick in three states with two hospitalized, after which Missouri closed the operationWe vaccinate the hens. Nobody checks the work.
  • 2018 — Rose Acre Farms, Hyde County, North Carolina. S. Braenderup. Forty-five sick in 10 states, 11 hospitalized, 206,749,248 eggs recalled. FDA’s warning letter found the outbreak strain in the processing plant and in manure from laying house No. 9, and laying houses rife with rodents.
  • 2018 — Gravel Ridge Farms, Cullman, Alabama. S. Enteritidis. Forty-four sick in 11 states, 12 hospitalized — a 32 percent hospitalization rate against a 20 percent norm.
  • 2024 — Milo’s Poultry Farms, Bonduel, Wisconsin. S. Enteritidis. Ninety-three sick in 12 states, 34 hospitalized, onsets from May 23 to September 13.
  • 2025 — August Egg Company, Hilmar, California. S. Enteritidis. One hundred thirty-four sick in 10 states, 38 hospitalized, one death in California. Onsets February 24 to June 6. 1.7 million dozen recalled.
  • 2025 — Country Eggs, LLC, Lucerne Valley, California. S. Enteritidis. One hundred five sick in 14 states, 19 hospitalized, onsets January 7 to August 14 — seven months, again.
  • 2026 — Midwest Poultry Services. S. Enteritidis. Ninety-eight sick in 17 states, 26 hospitalized, 1,589,577 dozen recalled.

About 2,500 counted illnesses, and counted is doing the work — these are only the multistate investigations. Four of them landed in the last three years. The last two each ran seven months before anyone pulled a carton. That is not a story about bad actors. It is a story about the interval between swabs.

Vaccination is the one thing the rule does not require. FDA looked at it in 2009 and decided the efficacy data weren’t strong enough to let a vaccine stand in for any prevention measure, and that finding has never been reopened. Here is what I missed: it did not need to be, because the industry vaccinates anyway. USDA’s National Animal Health Monitoring System surveyed 328 table-egg farms across 19 states and found 89.9 percent had vaccinated their layers as pullets, another 9.1 percent as pullets and again as layers, and 1.0 percent not at all. The most common protocol, on 39 percent of farms, was two live S. Typhimurium sprays followed by an inactivated bacterin injection, with about half of those farms giving the first dose at the hatchery. USDA also found that flocks vaccinated as pullets were markedly less likely to test positive for SE. Vaccination works. We already do it.

So the ask I closed with was the wrong ask. The hens were already vaccinated. Ninety-eight people got sick anyway, across seven months, and nobody pulled a carton until the seventh.

What Britain has that we do not is not the needle. It is everything built around it. Lion producers are audited independently and without warning. Lion eggs are tested, not just the houses they came from — USDA found 96.3 percent of American farms testing their layer-house environments and 5.8 percent testing eggs. Lion eggs carry a date on the shell and a record back to the flock. Our farms swab twice in a laying hen’s productive life and see an FDA inspector every three to five years. Between the swab and the carton there is nothing but time, and this time it was seven months of it.

We vaccinate the hens. Nobody checks the work.

The FDA and CDC, in collaboration with state and local partners, are investigating illnesses in a multistate outbreak of Salmonella Enteritidis infections linked, in part, to shell eggs recalled by Midwest Poultry Services, L.P. 

Based on epidemiological information collected by CDC, a total of 98 people infected with the outbreak strain of Salmonella have been reported from 17 states. Illnesses started on dates ranging from November 21, 2025, to June 30, 2026. Forty (91%) of 44 ill persons with information available reported eating eggs before becoming ill. There have been 26 hospitalizations, and no deaths have been reported.

Arizona, California, Colorado, Georgia, Illinois, Louisiana, Michigan, Missouri, Mississippi, North Carolina, New Mexico, Nevada, New York, Oklahoma, South Carolina, Texas, West Virginia.  

Laboratory, epidemiological, and traceback data from this investigation have determined that shell eggs recalled by Midwest Poultry Services, L.P are a likely source of illnesses in this outbreak. As part of this investigation, FDA conducted a traceback investigation based on where ill people reported purchasing or eating eggs during the timeframe of interest, and Midwest Poultry Services, L.P. was identified as a common egg source; however, this producer does not account for all the illnesses in this outbreak. Additional investigation is ongoing to determine if there are other sources of illness.

Additionally, Midwest Poultry Services, L.P. collected samples at farms in Texas. Certain samples collected by the firm tested positive for Salmonella, and whole genome sequencing performed by the firm’s third-party lab revealed that some samples match the strain of Salmonella in this outbreak.  

The firm shared third-party testing results with the FDA on July 21, 2026, and Midwest Poultry Services, L.P. proactively initiated a recall of white shell eggs and brown cage free shell eggs produced and distributed from farms in Texas between June 6, 2026 and July 3, 2026 with sell by or best by dates between July 20, 2026 and August 17, 2026. Consumers, restaurants, and retailers that purchased or received recalled eggs should throw them away or return them to their place or purchase for a refund and disinfect any areas that could have come in contact with recalled eggs.  

FDA’s investigation is ongoing, and this advisory will be updated with additional information as it becomes available.  

Case Count Map Provided by CDC

CDC Case Count Map - Outbreak Investigation of Salmonella Related to Eggs (July 24, 2026)

Product Distribution Map

Distribution of recalled products has been confirmed for states shown below, but product could have been distributed further, reaching additional states.

Product Distribution Map - Outbreak Investigation of Salmonella Related to Eggs (July 24, 2026)

Recalled Products

On July 22, 2026, Midwest Poultry Services, L.P. recalled white shell eggs and brown cage free shell eggs produced and distributed from farms in Texas between June 6, 2026 and July 3, 2026, with sell by or best by dates between July 20, 2026 and August 17, 2026. The recalled eggs will have an identifying code number printed on the left or right sides of the carton in date-coding ink only. Only codes P-1950 or 0840962 with a Julian Date between 157 and 184 printed on the side of the carton are recalled. Examples of this identifying plant and date information on retail cartons with some of the brands are included below.

Item Description Identifying Code UPC Julian Date 
Range 		Best By / Sell By Date 
Between: 
Kroger Large 12 eggsP-1950 or 840962011110609038157 to 184July 20 – August 17, 2026
Kroger Large 18 eggsP-1950 or 840962011110609335157 to 184July 20 – August 17, 2026
Kroger Large 60 eggsP-1950011110609144157 to 184July 20 – August 17, 2026
Kroger Extra Large 12 eggsP-1950 or 840962011110609045157 to 184July 20 – August 17, 2026
Kroger Medium 12 eggsP-1950 or 840962011110609021157 to 184July 20 – August 17, 2026
Kroger Medium 30 eggsP-1950011110609809157 to 184July 20 – August 17, 2026
Kroger Jumbo 12 eggsP-1950 or 840962011110609052157 to 184July 20 – August 17, 2026
Simple Truth Cage Free Medium 
Brown 12 eggs		P-1950011110870230157 to 184July 20 – August 17, 2026
Simple Truth Cage Free Large 
Brown 12 eggs		P-1950011110797704157 to 184July 20 – August 17, 2026
Simple Truth Cage Free Large 
Brown 18 eggs		P-1950011110893109157 to 184July 20 – August 17, 2026
Simple Truth Cage Free Large 
Brown 24 eggs		P-1950011110150974157 to 184July 20 – August 17, 2026
Brookshire’s Large 12 EggsP-1950092825095552157 to 184July 20 – August 17, 2026
Brookshire’s Large 18 EggsP-1950092825095569157 to 184July 20 – August 17, 2026
Brookshire’s Large 36 eggsP-1950092825109808157 to 184July 20 – August 17, 2026
Brookshire’s Large 60 eggsP-1950092825095637157 to 184July 20 – August 17, 2026
Brookshire’s Large 6 eggsP-1950092825095644157 to 184July 20 – August 17, 2026
Brookshires Extra Large 18 EggsP-1950092825095606157 to 184July 20 – August 17, 2026
Brookshire’s Jumbo 12 EggsP-1950092825095583157 to 184July 20 – August 17, 2026
Country Morning Large 12 EggsP-1950078566200004157 to 184July 20 – August 17, 2026
Country Morning Large 18 EggsP-1950078566005036157 to 184July 20 – August 17, 2026
Country Morning Large 2 ½ 
Dozen		P-1950079307005162157 to 184July 20 – August 17, 2026
Country Morning Extra Large 12 
Eggs		P-1950078566001021157 to 184July 20 – August 17, 2026
Country Morning Medium 12 
Eggs		P-1950078566001045157 to 184July 20 – August 17, 2026
Country Morning Jumbo 12 EggsP-1950078566001014157 to 184July 20 – August 17, 2026
Sunups Medium 2 1/2 DozenP-1950028621304987157 to 184July 20 – August 17, 2026
Grade AA Large Bulk X 30 
DOZEN		P-1950N/A157 to 184July 20 – August 17, 2026
Grade A Large Bulk X 15 DOZENP-1950N/A157 to 184July 20 – August 17, 2026
Grade A Large Bulk – TICTACP-1950N/A157 to 184July 20 – August 17, 2026
Grade A Large Bulk – BROWN – 
TICTAC		P-1950N/A157 to 184July 20 – August 17, 2026
Grade A Medium Bulk X 30 
DOZEN		P-1950N/A157 to 184July 20 – August 17, 2026
Grade A Medium Bulk X 15 
DOZEN		P-1950N/A157 to 184July 20 – August 17, 2026
Grade A Extra Large Bulk X 15 
DOZEN		P-1950N/A157 to 184July 20 – August 17, 2026
Grade A Jumbo Bulk 20 eggsP-1950N/A157 to 184July 20 – August 17, 2026

Product Images

Outbreak Investigation of Salmonella Related to Eggs (July 2026) - Sample Product Image
Sunups Egg Carton
Country Morning Egg Carton
Brookshire's Egg Carton
Kroger Egg Carton
Kroger Egg Carton

At five o’clock this morning Eastern time, the Washington Post reported that the Centers for Disease Control and Prevention has linked four more states to the Cyclospora outbreak traced to iceberg lettuce from Taylor Farms de Mexico. Illinois, Kansas, Oklahoma and Pennsylvania join Indiana, Kentucky, Michigan, Ohio and West Virginia. Nine states.

CDC’s own outbreak pages say five. The investigation update was last reviewed July 16 and still reads 1,644 people, five states, 94 hospitalizations, onsets from May 13 through July 13. The map of where people got sick carries the same July 16 stamp and colors in the same five states. FDA’s advisory is titled for a five-state outbreak, is stamped current as of July 17, and lists Indiana, Kentucky, Michigan, Ohio and West Virginia under “States with Cases.” 

The Post has sources and the agencies have a publication schedule. Lena Sun’s story is attributed to two individuals familiar with the investigation. Reuters picked it up and said plainly that it could not verify the report and that CDC could not be reached outside business hours. The Post reported that patients in the four added states may have gotten sick around the same time as those in the original five, and that investigators simply needed longer to determine whether those illnesses belonged to the same outbreak. That is not a new wave. That is the same wave, finally counted.

It is also worth noting that the states got there before the newspaper did, and they got there by watching their own numbers climb. On July 22, two days before the Post story, the Kansas Department of Health and Environment said in its own newsflash that after further investigation it could now confirm some Kansas cases are connected to the outbreaks occurring nationally. Kansas had gone from 55 reported cases on July 15 to 289 on July 22 — more than a fivefold jump in one week, better than 30 percent of them in Johnson County. Oklahoma said it even earlier. The Oklahoma State Department of Health told News 9 in Oklahoma City and News On 6 in Tulsa that multiple Oklahoma cases were linked to Taco Bell and that it was working with FDA to trace them back to the Taylor Farms shredded lettuce. Oklahoma’s own count went from 56 on July 14 to 172 on July 21, and the state health department posted a wrong figure that morning and corrected it the same day.

Illinois is the useful contrast. IDPH reported 408 confirmed and probable cases as of July 21 — 215 acquired domestically, 145 in travelers, 48 unknown, with 31 people hospitalized — after reporting 215 a week earlier. The count nearly doubled in seven days. What Illinois has not done is name a source; the department says no single cause has been identified for the increase. Pennsylvania has not linked its cases either. Two of the four states the Post reports CDC has now added had already tied themselves to this outbreak in public; two had not. Either way, the record was sitting on state websites before it appeared in a newspaper, and it is still not on CDC’s outbreak page.

Here is what the nine states are actually reporting, using each state’s own published count rather than CDC’s outbreak figure. The dates differ because the states update on different days, and three of these numbers are already a week old.

State2026 cases the state itself reportsAs ofIn CDC’s five-state outbreak?Source
Michigan7,664 (160 hospitalized)Jul 23YesMDHHS outbreak page
Ohio1,316 statewide (96 hospitalized)Jul 16Yes — statewide figure not updated since July 16; northwest Ohio alone reported 2,380 on July 23Ohio Capital Journal · Toledo Blade
Indiana684Jul 23YesIndiana Department of Health
West Virginia195 (15 hospitalized)Jul 21YesWV OEPS
Kentucky192 reported / 108 confirmed (7 hospitalized)Jul 15YesKentucky Dept. for Public Health, via WTVQ
Five-state totalabout 10,050—CDC counts 1,644 in this outbreak, with 94 hospitalizationsCDC investigation update
Illinois408 confirmed and probable (31 hospitalized; 215 domestic)Jul 21Newly linked per the Washington Post; IDPH itself says no single source identifiedIDPH, via CBS Chicago · WTVO/WQRF
Kansas289 (12 hospitalized; was 55 on Jul 15)Jul 22Newly linked per the Washington Post; KDHE said on July 22 that some Kansas cases are connected to the national outbreaksKDHE · KCTV
Oklahoma172 (12 hospitalized; was 56 on Jul 14)Jul 21Newly linked per the Washington Post; OSDH had already said multiple Oklahoma cases were linked to Taco BellOSDH, via KOSU · News 9 · KSWO
Pennsylvania28Jul 16Newly linked per the Washington Post; state has not linked its own cases, and cyclosporiasis reporting in Pennsylvania is voluntaryPennsylvania DOH, via ABC27 · WESA
Four newly linked statesabout 900—Not yet reflected on CDC’s or FDA’s outbreak pagesWashington Post
Nine-state totalabout 10,950—A floor, not a total — the reporting dates differ and CDC assumes a six-week lagCDC surveillance

Two things in that table deserve to be said out loud. The first is Pennsylvania. It is now one of the four states newly tied to a national foodborne outbreak, and cyclosporiasis is not on Pennsylvania’s list of reportable conditions — physicians report it voluntarily, a limitation CDC footnotes on its own surveillance page. Pennsylvania’s 28 cases are not a measurement of how many Pennsylvanians got sick. They are a measurement of how many doctors chose to pick up the phone.

The second is Ohio, which is keeping two sets of books. The state health department’s most recent statewide figure is 1,316 as of July 16, with 96 hospitalizations. Northwest Ohio alone reported 2,380 cases on July 23, with 1,074 in Lucas County. A region inside Ohio is reporting nearly twice what Ohio is reporting. On Thursday, at the state’s request, CDC agreed to send disease detectives to Ohio for about three weeks.

A tip of the pen, again, to Lena H. Sun at the Washington Post, who has been out in front of this outbreak for a week and a half and put Taylor Farms in print on July 16, the day before FDA named the supplier itself. 

The credit belongs further down the masthead too. Almost every number in the table above reached the public through a local reporter, not a federal notice. The Toledo Blade is the only outlet counting northwest Ohio day by day, which is the only reason anyone knows a corner of one state is reporting nearly twice what the state is. WISH-TV in Indianapolis has been reading the Indiana dashboard every afternoon. KCTV in Kansas City caught the Kansas quadrupling. KSWO in Lawton caught Oklahoma’s health department posting a bad number and correcting it the same day. WESA in Pittsburghis the reason I can tell you that cyclosporiasis reporting in Pennsylvania is voluntary. FOX19 in Cincinnati got the disease-detectives deployment out of a county health department, and The Hill’s Nexstar team built its own fifty-state tally out of CDC data, state data and local reporting because no one else had. KBIA in Columbia is why anyone knows Missouri — a state that logs about a dozen cases in a normal year — is at 216. Reporters in Michigan, Ohio, Kentucky and North Carolina have been doing the same work all month.

None of which makes the reporting the problem. The problem is that on a Friday in the eleventh week of the largest Cyclospora outbreak in American history, a mother in Tulsa or Wichita or Harrisburg who wants to know whether her state is part of it has to read a newspaper with a paywall, because the federal pages built for exactly that purpose have not been touched since July 16.

Outbreak notices are not press clippings. They are how the public health system tells people what happened to them and what to stop eating. The Washington Post published the ninth state at five o’clock this morning. CDC’s outbreak page has not changed since July 16.

Every time Taylor Farms turns up at the center of an outbreak, the company says the same thing — this is an isolated event, our branded products are not involved, we acted quickly. So let us put the record in one place. What follows is every Taylor Farms outbreak I can verify from public sources, with the pathogen, the dates, the number of people sickened, and the product. I know these personally, because I represented the people and families impacted.

Then every recall I can verify, sorted by pathogen. Read them together and a pattern shows up that no single press release can explain away.

Pay particular attention to the gap between the two lists. Three of the largest outbreaks on this page — 2013, November 2024, and the 2021 romaine cluster — produced no recall at all. Two more produced recalls that went only to foodservice customers by direct notice, with nothing posted for the public to read.

Outbreaks with Recalls or Not

2009 — Salmonella Typhimurium — shredded lettuce. Shredded lettuce sickened 145 people in the western United States and at least 12 more in Canada. The product was shredded lettuce sold into fast-food and foodservice accounts, and the illnesses pointed at the processing step rather than at any one restaurant. No recall. This is the outbreak nobody remembers, four years ahead of everything else on this list.

June–August 2013 — Cyclospora — bagged salad mix. 631 people in 25 states were sickened. Iowa and Nebraska health officials concluded that the restaurant cases in their states traced to a salad mix produced by Taylor Farms de Mexico, served at Olive Garden and Red Lobster. The Texas cases, a large share of the national total, were never conclusively tied to the same product. FDA inspected the Guanajuato plant that August and produced the environmental assessment that remains the single most-cited document in this company’s history. No recall was issued. Production was suspended; the product already in commerce stayed there.

November 2015 — E. coli O157:H7 — celery and onion diced blend. Nineteen people in seven states were infected, five were hospitalized, two developed hemolytic uremic syndrome and one required a kidney transplant. The vehicle was Costco’s rotisserie chicken salad; the ingredient was the celery and onion diced blend from Taylor Farms Pacific in Tracy, California. Montana’s public health laboratory got a presumptive positive off a retail sample. Taylor Farms Pacific recalled the blend and many other celery-containing products on November 26, 2015, and the recall grew past 155,000 items across Costco, Walmart, Sam’s Club, Target, Safeway, 7-Eleven and Starbucks. FDA’s follow-up analysis could not confirm the organism, and the company has called it a false alarm ever since. Nineteen people were still sick.

November 2021 — E. coli O121:H19 — romaine lettuce. A small cluster, and a telling one. Two Washington cases reported eating romaine at Panera Bread and two Minnesota cases reported eating romaine at Chipotle; the lettuce traced back to Taylor Farms. No recall, and no CDC advisory. The traceback landed and the public was never told.

May 2023 — Cyclospora — Taco del Gnar, Ridgway, Colorado. The Colorado Department of Public Health and Environment and Ouray County Public Health investigated Cyclospora infections among patrons of a single restaurant, with fresh produce implicated and the supply chain running back to Taylor Farms. The public entry does not carry a case count. No recall. A documented single-restaurant Cyclospora cluster is rare, and this one sits three years ahead of the current outbreak with the same parasite and the same supplier.

October–December 2024 — E. coli O157:H7 — slivered yellow onions. One hundred four people in fourteen states, 34 hospitalized, four with hemolytic uremic syndrome, and one dead in Colorado. Sixty-three of 75 people interviewed — 84 percent — reported a menu item containing fresh slivered onions, and FDA’s traceback pointed at the onions served on McDonald’s Quarter Pounders. Taylor Farms initiated a voluntary recall of yellow onions on October 22, 2024 and notified its foodservice customers directly. There was no consumer-facing recall notice. FDA closed the investigation without ever recovering the outbreak strain from an onion, and the Colorado Springs plant drew a Form 483.

November 2024 — E. coli O157:H7 — romaine lettuce. Eighty-nine people in fifteen states, with onsets from November 4 to November 30, 2024. Thirty-six were hospitalized, seven developed HUS, and one person died. CDC and FDA closed the investigation in January 2025 without telling the public which company grew the lettuce. Our own epidemiologist found the common thread among clients who were whole-genome-sequencing matches to one another, and the name came out through federal court filings in April 2025. No recall. Fifty of the 89 were in Missouri, most of them from salads catered at a St. Louis high school. Taylor Farms denies every bit of it. In a statement to The Packer, the company said “Taylor Farms product was not the source of the referenced 2024 E. coli outbreak,” maintaining that its raw and finished product testing showed nothing and that tying its products to these illnesses was unfair to the families who got sick. Set that against what the traceback actually found: a single processor sourcing romaine from a single grower, with the lettuce at four of the five points of service running back to the same ranch and the same lot – See FDA Report

May–July 2026 — Cyclospora — shredded iceberg lettuce. The one we are living through. CDC has confirmed 4,173 cases since May 1 and is working to confirm roughly 7,400 more; Michigan alone reported 7,171 cases as of July 22. FDA’s traceback converged on a single supplier, Taylor Farms de Mexico, which provided the shredded iceberg lettuce used at Taco Bell locations where sick people ate in Indiana, Kentucky, Michigan, Ohio and West Virginia. Taylor Farms de Mexico recalled all central-Mexico iceberg lettuce on July 17, 2026; the shredded product had gone into 27 states between June 29 and July 16, and Marketside-brand consumer bags were pulled from Walmart stores in 15 states — which is worth remembering every time you hear that only restaurants were affected.

Recalls by Pathogen

Cyclospora cayetanensis

July 17–18, 2026 — shredded iceberg lettuce and iceberg salad, Taylor Farms de Mexico; foodservice in 27 states, Marketside consumer bags at Walmart in 15 states.

E. coli O157:H7

November 26, 2015 — celery and onion diced blend and other celery-containing products, Taylor Farms Pacific; expanded past 155,000 items.

October 22, 2024 — whole peeled, jumbo peeled and diced yellow onions; foodservice customers notified directly, no public notice.

Salmonella

May 2, 2011 — ready-to-eat salad kits containing recalled Six L’s grape tomatoes, Taylor Farms Pacific; about 22,000 pounds on the USDA side.

March 2018 — 3/8-inch diced yellow onions, Taylor Farms California Foodservice; no FDA or company notice was ever posted, only the downstream grocer’s.

August 2020 — diced onions, salads, stir fry and mirepoix, Taylor Farms Texas; Marketside and Taylor Farms brands at Walmart and Kroger in 11 states.

2021 — Taylor Farms brand Maple Bourbon Chopped Kit, 315 g, recalled in Canada; Class 2. A branded consumer salad kit.

Listeria monocytogenes

October 2013 — broccoli salad kits, 5,084 pounds, on account of dressing packets under FDA recall; a companion Taylor Farms action pulled about 5,000 units of broccoli salad across 23 states.

February 11, 2017 — chicken and pork salad products, 6,630 pounds, from the Dallas and Tracy plants.

October 23, 2021 — Taylor Farms Mushroom Stir Fry, 9 oz., Kroger stores in eight states.

February 9, 2024 — Marketside Bacon Ranch Crunch Salad Kit, on the expanded Rizo-López Foods cheese recall.

Undeclared allergens and misbranding

October 24, 2014 — walnuts, Signature Café Broccoli Kale Salad with Chicken, 377 pounds.

May 26, 2016 — wheat and sesame, Wawa Thai style chicken mango salad, 151 pounds.

August 7, 2017 — milk, Taylor Farms Creamy Homestyle Coleslaw Kits, 293 cases.

October 28, 2017 — fish (anchovies), salads with chicken, Taylor Farms Florida, 732 pounds.

August 29, 2018 — egg and wheat, homestyle beef and pork meatloaf, Taylor Farms Illinois, 75 pounds.

May 14, 2019 — Caesar salad with chicken, Taylor Farms Texas, 1,079 pounds.

May 27, 2022 — wheat and egg, Trader Joe’s Lemony Arugula Basil Salad Kit, Taylor Farms Retail.

March 13, 2024 — wheat, Kroger apple walnut with chicken salad bowls, Taylor Farms Pacific, 19,976 pounds.

August 26, 2025 — sesame and soy, Taylor Farms Honey Balsamic Salad Kit, 25 states.

Processing defect

August 9, 2019 — breaded chicken products that may have been undercooked, Taylor Farms Illinois, 342 pounds.

A Note on What Is Missing

This list is not complete, and I want to be plain about why. FDA’s public recall page carries only the announcements a company chooses to make public. The quiet ones — the direct-to-customer foodservice recalls, the low-classification actions nobody writes a press release about — are recorded instead in FDA’s Enforcement Report Database, which is searchable by firm and covers 2004 to the present. Anyone doing this work should run that search under every corporate name the company files under: Taylor Farms Retail, Taylor Farms Pacific, Taylor Farms Texas, Taylor Farms California Foodservice, Taylor Farms Illinois, Taylor Farms Florida, Taylor Farms Tennessee, Taylor Farms Maryland, Taylor Farms de Mexico, and Taylor Fresh Foods. Search one string and you will miss most of them. Meat and poultry recalls sit with USDA’s Food Safety and Inspection Service instead, which is why so many of the entries above point there.

Here is the thing I keep coming back to. The two outbreaks on this page that killed someone — the onions in October 2024 and the romaine in November 2024 — are also the two where the public was never given a recall notice to read. In the first, customers were told and consumers were not. In the second, nobody was told at all until we filed suit.

Three federal maps describe the 2026 Cyclospora Summer. Read in order, they move from what has been established, to what is documented but unexamined, to what nobody has yet explained.

CDC, Where People Got Sick: Cyclospora Outbreak, July 2026 — last reviewed July 16, 2026.

This part is settled. FDA’s traceback investigation identified convergence on a single supplier of iceberg lettuce, Taylor Farms de México, used by the Taco Bell locations where sick people ate before becoming ill. CDC reported 1,644 people infected with Cyclospora and reporting Taco Bell exposure across five states, with 94 hospitalizations and illness onsets running from May 13 to July 13. Michigan analyzed food exposure details from 190 of those cases, and 90 percent reported eating iceberg lettuce. The company announced a recall on July 17. The link from restaurant to supplier to recall is not in dispute.

Taylor Fresh Foods recall notice announced July 17 and posted by FDA July 18, 2026.

Then the same lettuce turns out to have gone much further. The recall notice states that the shredded iceberg product was distributed between June 29 and July 16 in twenty-seven states: Alabama, Arkansas, Connecticut, Florida, Georgia, Iowa, Illinois, Indiana, Kansas, Kentucky, Louisiana, Massachusetts, Maryland, Michigan, Missouri, Mississippi, North Carolina, New Hampshire, New Jersey, Ohio, Oklahoma, Pennsylvania, South Carolina, Tennessee, Texas, Virginia and Wisconsin.

CDC, Surveillance of Cyclosporiasis. Bands read from CDC’s published case-location map.

And this is the part nobody has explained. CDC’s surveillance page reports 4,173 laboratory-confirmed domestically acquired cases since May 1, 2026, plus more than 7,400 additional cases not yet laboratory confirmed, many of them from Michigan and Ohio — roughly 11,600 people across forty-two states and the District of Columbia. The five-state Taco Bell cluster is a subset of that. What accounts for the rest has not been established.

The question worth pressing is whether the distribution map explains the case map. It is not proof either way, but the pattern leans one direction.

Twenty-five of the twenty-seven states that received the recalled lettuce report cases — all but New Hampshire and South Carolina. That is 93 percent, against 74 percent of the states that did not receive it. On its own that comparison proves very little, because with cases in forty-two of fifty states almost any distribution list would overlap heavily.

The stronger signal is where the burden sits. Nine states report 81 or more cases. Eight of the nine received the recalled lettuce: Michigan, Ohio, Indiana, New Jersey, North Carolina, Illinois, Kentucky and Texas. Meanwhile the seventeen states with cases that are absent from the distribution list are overwhelmingly minimal — ten of them sit in the lowest band of one to ten cases, which is roughly what background cyclosporiasis looks like in a normal summer. The heavy states got the lettuce. The states that did not get the lettuce are mostly barely affected.

Two states break the pattern, and both are worth an answer. New York carries between 161 and 300 cases and does not appear on the distribution list at all — the only high-burden state that does not. West Virginia is one of the five states in CDC’s own outbreak map, with confirmed illnesses tied to Taco Bell locations FDA named, and it does not appear on the company’s list either.

Neither gap has an innocent explanation on the public record. Either the product reached those states through a channel the recall notice does not capture, or the two lists were built from different records, or New York’s cases have a different source entirely. Any of those is answerable with documents the company and the agencies already hold: the full customer list behind the recall, the distribution records for the thirty-four product lines the notice does not describe, and the state-level exposure interviews CDC has collected but not published.

Three limits on the comparison, all of which understate rather than overstate it. The twenty-seven-state figure describes the shredded iceberg line only; the recall spans thirty-five product lines, including the Marketside retail bags sold at Walmart, and the notice gives no distribution list for the rest — so the true distribution footprint is larger than twenty-seven, not smaller. The national case map counts all 2026 cyclosporiasis cases, not only those traced to this supplier, so not every shaded state is a Taylor Farms state.

FDA’s table of active foodborne illness investigations currently lists six separate Cyclospora outbreaks running at once. Exactly one has a product attached to it. Reference 1390 is the Taco Bell cluster, where FDA’s traceback converged on Taylor Farms de México and the company pulled its iceberg lettuce from the market. The other five are blanks. Referecne 1392, opened July 22, 72 illnesses, product yet identified. Reference 1385, opened July 8, eight illnesses, product not yet identified. Reference 1384, opened the same day, eighteen illnesses, product not yet identified. Reference 1381, opened June 17, two illnesses, product not yet identified. Reference 1375, opened June 3, eight illnesses — an outbreak FDA now lists as ended, with the investigation still open and the source still unknown. FDA has opened traceback on every one of them and collected samples in some. It has not conducted a single on-site inspection in connection with any of them, and not one has produced a recall.

That matters more than it looks. For this parasite, “not yet identified” resolves to “never identified” about half the time. FDA closed a Cyclospora investigation in July 2025 with 48 illnesses having never identified the product at all and closed another in August 2025 with 69 illnesses that it did manage to trace to parsley. Five open blanks during the largest cyclosporiasis outbreak in American history is not a bookkeeping curiosity. If a second contaminated commodity is moving through the food supply alongside the lettuce, those five files are where it would surface — and right now they are five traceback exercises with no inspections behind them.

In November 2013, after Cyclospora cayetanensis sickened hundreds of people in Iowa and Nebraska, FDA published an environmental assessment of the Taylor Farms de México processing plant at Doctor Mora, Guanajuato. The report closed with recommendations. The second told the firm to determine whether Cyclospora is a reasonably likely hazard in the Guanajuato leafy green growing region and, if it is, to re-evaluate the wash step used on salad mix. Thirteen years later the same region sits at the center of the largest cyclosporiasis outbreak in American history, and no one has produced a document showing that determination was ever made.

Here is what a hazard analysis would have found, had anyone performed one. Two hundred and thirty-five meters from the processing building — roughly eight hundred feet, a three-minute walk — sits Balneario Las Fajanas, a public thermal-water bathing complex with pools, water slides, changing rooms, showers, grills and picnic shelters, open every day of the year. It is the largest concentration of human fecal loading anywhere near that plant. And satellite imagery establishes that it was already built, filled and operating in March 2010, more than three years before FDA and COFEPRIS ever set foot on the property.

March 4, 2010. Taylor Farms de México at center; Balneario Las Fajanas at lower right, pools filled, buildings and mature tree cover in place. More than three years before the FDA and COFEPRIS assessment. Google Earth historical imagery.

That image forecloses the only innocent explanation. Nobody can now say the balneario came later, or that the environment changed after the inspectors left. When FDA and COFEPRIS walked that site in August 2013, a public bathing facility with filled pools stood across the highway in plain view and had stood there for years. The published assessment describes the processing plant and five ranches. It does not describe a bathing complex. 

It is worth setting out what is actually on that property, because the detail matters. The Guanajuato Secretariat of Tourism lists Las Fajanas in its official state guide under balnearios and water parks, at Km 16 of the San Miguel de Allende–Doctor Mora highway, locality of Cruz de la Maza, with state-published coordinates of 21.10266, -100.45159. The state describes thermal-water pools, extensive lawns, parking, water slides, palapas, grills, restrooms, showers, changing rooms and a snack shop, and flags the site as accessible. Other listings add a soda fountain, a store, sports courts and a bar. The operator advertises thermal water held at 40 degrees Celsius and promotes that the facility is open 365 days a year. Admission has climbed steadily — 80 pesos for adults and 40 for children in earlier listings, 100 and 40 after that, 120 and 60 from the first of February, and 150 adults and 80 children from the twenty-third of March. Prices rise like that when demand supports it. The Google listing carries 897 reviews. There is no website; the business runs on Facebook.

Water slides produce high water ingestion, particularly among children. Grills and picnic shelters mean families stay all day rather than an hour, which multiplies restroom use per visitor. Thermal water at 40 degrees means the facility is drawing from a deep geothermal source and moving large volumes of it — and every liter that goes into a pool eventually comes out of one. Where it goes when it leaves is the entire question, and no public listing answers it.

June 14, 2023. The same frame. The balneario is largely unchanged. The Taylor Farms facility is not — note the enlarged processing building, the solar array at left, the formal employee parking, and the trailer yard across the top of the image. Google Earth historical imagery.

Put the two frames side by side and a second argument appears, one that has nothing to do with the balneario. The bathing complex in 2023 looks much as it did in 2010. The Taylor Farms facility does not. The 2010 image shows a moderate plant: one main building, blue-roofed outbuildings, a large unpaved graded area to the north. The 2023 image shows a substantially larger processing building, a solar array along the western boundary, hundreds of employee vehicles in formal parking rows, and a trailer yard holding well over a hundred units. That is not incremental growth. That is a different scale of operation — more throughput, more wash water, more workers, more waste.

One more feature is visible in both frames and deserves attention from someone qualified to identify it. A linear channel runs east to west immediately north of the highway, between the plant and the balneario, and appears to hold water in both images. The 2023 frame also shows a standing water body along that channel southwest of the plant. If that is an irrigation canal or a drainage ditch, it is a surface pathway between the two properties — and surface connection is far easier to establish than aquifer connection. It would also have been visible from the plant yard in 2013. Separately, the 2010 frame shows a dark oval pond immediately southwest of the main building that I cannot find in the 2023 frame. If that was a retention or process-water lagoon, its disappearance during the expansion is a records question worth asking.

Cyclospora cayetanensis has no animal reservoir. Cattle do not carry it, wildlife does not carry it, birds do not carry it. It completes its life cycle in human beings and nowhere else. Every oocyst that ends up on a leaf of iceberg lettuce came out of a person. With E. coli O157:H7 you go looking for a feedlot upgradient of the field. With Cyclospora you go looking for human sewage.

Cyclospora Oocysts are shed unsporulated and non-infectious. They must sit in the environment for roughly one to two weeks at temperatures between about 22 and 32 degrees Celsius before they can infect anyone, which is why CDC says direct person-to-person transmission is unlikely. A sick person cannot hand this parasite to the person beside them. What that person can do is deposit inert oocysts into soil or water, walk away, and leave them to ripen. And northeastern Guanajuato is close to ideal for that ripening: mean daily maximum temperatures at San José Iturbide run from about 23 to 31 degrees Celsius across the entire year, sitting inside the sporulation window in every month.

I want to be careful here, because there is a version of this argument that is wrong. On July 15 the International Fresh Produce Association faulted Michigan’s health department for saying recreational water is not a recognized risk factor, cited three papers for the proposition, and told The Packer that Michigan was defying reputable science. Its consumer FAQ still tells readers that pool chlorine will not kill Cyclospora and that people who swallow pool water are not protected the way they would be from other waterborne illnesses. County health departments in Ohio and Arizona have said much the same thing. The implication running through all of it is that swimmers are catching this. They are not.

The most recent global review of waterborne protozoan outbreaks, published by Bourli and colleagues in the Journal of Water and Health in 2023 and the fifth in a series running since 2007, catalogued 416 outbreaks worldwide between 2017 and 2022. Recreational water and swimming pools were the suspected source in 313 of them — three quarters of the total — and 92 percent of those were Cryptosporidium. Cyclospora caused three outbreaks in the entire six-year window, and the review lists each one by name: drinking water in Poland traced to travelers from Indonesia, drinking water in South Korea traced to travelers who drank at a church in Nepal, and a British cluster among travelers returning from Mexico whose recorded exposures were fruit, salad vegetables, fresh herbs, bottled water and ice. Not one of them is a pool. Cryptosporidium owns that category, because Cryptosporidium is infectious the moment it leaves the body. Cyclospora is not. A health department urging caution about pools is being careful. A trade association telling you recreational water is a live risk factor in this outbreak is doing something else. It is moving the story off lettuce.

The defensible argument is not that the balneario infected swimmers. It is that the balneario is a fecal loading point into the environmental water system surrounding a ready-to-eat produce plant. And that mechanism is not my invention. It is the express premise of the research the produce industry has been funding for a decade.

The Center for Produce Safety states plainly that it has invested 1.6 million dollars in Cyclospora research since 2014, and that the results confirmed the parasite is endemic in the United States and can be recovered from wastewater and irrigation water, which it calls a significant risk for produce contamination. That is the industry’s own research arm saying the parasite lives in sewage and reaches crops through water. Go one level down and the mechanism gets named outright: a CPS and USDA-listed project led by Charles Gerba, Kelly Bright, Paula Rivadeneira and Walter Betancourt at Arizona was built to determine whether American produce is at risk from irrigation water contaminated by human sewage, and it specifies the sources — faulty and leaking septic systems, compromised sewer pipes, and treated wastewater effluent discharged into surface waters used to irrigate food crops. The USDA National Agricultural Library listing carries the identical framing. Faulty septic near produce ground is not a theory I am floating. It is a funded federal research question.

The surveillance results tell you where the parasite actually is. A two-year study in a Southeastern Georgia growing region, published in the Journal of Food Protection and funded through CPS, sampled municipal wastewater sludge, on-farm portable toilets, irrigation pond water and spent packinghouse dump tank water. The parasite lives in human sewage, reliably. And an unconfirmed molecular positive on agricultural water is a known published artifact — precisely what happened at the border in July, and why that false positive proved nothing about whether the lettuce was contaminated.

Treatment does not solve it. Kitajima, Haramoto, Iker and Gerba sampled two Arizona wastewater treatment plantsmonthly for a year, detected Cyclospora in wastewater with a purpose-built assay, and concluded that conventional treatment is limited in its ability to remove protozoan oocysts and cysts. That is a functioning municipal plant. A rural recreational facility is not going to do better. Nor is any of this new: Sterling and Ortega reported in Emerging Infectious Diseases that Cyclospora oocysts were recovered from sewage lagoons beside an endemic area of Lima, and that water from those lagoons irrigates pasture, corn, and elsewhere in the city, vegetable crops. That was 1999.

Straight-line distances computed from published coordinates. The processing plant is at 21.10634° N, 100.45266° W.

Taylor Farms will argue it cannot control what its neighbors put into the ground. That argument fails on the 2013 record. FDA told Taylor Farm, in writing, to determine whether Cyclospora is a reasonably likely hazard in this growing region, and if it is, to re-evaluate the wash step. A hazard analysis worth the paper it is printed on would have identified a public bathing complex eight hundred feet from the intake — a bathing complex that the satellite record now proves was sitting there, pools filled, three years before the inspectors arrived. The failure here is not that the balneario is there. The failure is that the federal government said look, and thirteen years and one record-breaking outbreak later, no one can show that anybody did.

Mexico’s health secretary, David Kershenobich, told reporters Tuesday that his government has found no evidence that the outbreak sickening thousands of Americans began on a lettuce farm in Guanajuato. He said Mexico is taking precautions anyway, and its food-safety agencies, Cofepris and Senasica, say they are running preventive inspections and traceability checks in the state. It is a careful statement, and a defensible one on its own terms. It is also the newest verse in a song that has played for two weeks: Taylor Farms says it was less than one percent of the iceberg supply, the produce trade groups say the case rests on interviews, and now a national government says no laboratory result points its way. Every one of them is standing on the same fact — that no sample of the lettuce has tested positive for the parasite. For this parasite, that fact means almost nothing.

Here is why. Cyclospora cannot be grown in a laboratory — there is no culture, no animal model, no way to multiply it and confirm it the way a lab confirms Salmonella or E. coli. Detecting it means finding its DNA on the produce itself, and the produce is lettuce: it is eaten or thrown away within days, while the people who ate it do not fall sick for a week and are not counted for a month or more. By the time investigators know an outbreak exists, the lots that caused it are gone. Contamination is patchy, too — a clean twenty-five-gram sample says nothing about the leaf beside it. So, a negative test is not evidence of a safe field. It is evidence that the evidence was eaten. The one positive sample the FDA did announce, from Taylor Farms de Mexico lettuce, it retracted two days later as a false positive. The absence that remains is not exoneration. It is the ordinary condition of a Cyclospora investigation.

What investigators have instead is the thing that actually breaks these outbreaks open: sick people and a supply chain. Sixteen hundred and forty-four of them. That is how many people across five states — Indiana, Kentucky, Michigan, Ohio and West Virginia — caught Cyclospora after eating at Taco Bell, with illnesses starting between May 13 and July 13 and ninety-four of them hospitalized. Sixteen hundred strangers in five states do not share a rare parasite by coincidence. They shared a restaurant. Michigan interviewed one hundred ninety of its Taco Bell patients, and ninety percent had eaten the iceberg lettuce; the FDA then traced that lettuce back through the chain, and it converged on one supplier — Taylor Farms de Mexico, in central Mexico. That is the evidence, and it is the part the minister’s statement steps around. A positive lab sample would be welcome, but it is not required and never has been. As NBC noted this week, a positive test is not necessarily needed to name a source. What names it here is 1,644 people and one farm at the end of every thread.

And 2013 is the part the statement left out. The same Guanajuato facility — Taylor Farms de Mexico — was the source of a Cyclospora outbreak that sickened more than six hundred people across twenty-five states, traced to salad mix served at Olive Garden and Red Lobster. There was a no-evidence-yet posture then, too, and stepped-up border screening, and a company that pulled far more product than the implicated lot. No one wanted to be the answer. Eleven years later the answer was the same place.

The count is not waiting for anyone’s certainty. CDC now reports 4,173 laboratory-confirmed domestic cases since May 1 and says it is aware of more than 7,400 additional cases not yet confirmed — many of them in Michigan and Ohio — for a national total above eleven thousand five hundred across forty-one states, with three hundred and eight people hospitalized. Michigan alone reported 7,171 cases on Wednesday, up six hundred in a single day. The states themselves add up to a little more; below is where each one stands tonight, with the source for every number.

State2026 cases reportedPart of the Taco Bell outbreak?Source
AlabamaNo 2026 count publishedNot reported as part of the outbreakCDC
Alaska5; 3 travel-relatedNo – AK DOH: no link to the outbreakAK DOH / Epoch
Arizona19Cases reported; not in clusterAZ DHS / Epoch
Arkansas26 year-to-dateUnder investigation for outbreak linkAR DOH / Epoch
California41 provisional (Jul 14); CDC lists 97No – CDPH: no local acquisition identifiedCDPH
Colorado150; 4 hospitalized; 8 of 120 domesticNo – CDPHE: not part of the Midwest outbreakCDPHE / Epoch
Connecticut35 (up from 19 in 2025)Links its cases to the national outbreakCT DPH
DelawareNo 2026 count publishedNot reported as part of the outbreakCDC
Florida106No – FL DOH: seasonal disease Florida sees yearlyFL DOH / Epoch
Georgia11–30 domestic since May 1; CDC lists 71No – GA DPH: no Georgia-specific clusterGA DPH / Epoch
HawaiiNo 2026 count publishedNot reported as part of the outbreakCDC
IdahoNo 2026 count publishedNot reported as part of the outbreakCDC
Illinois277 (Jul 16); 23 hospitalized; CDC lists 87No – IDPH: higher than average, no single causeIDPH / TODAY
Indiana327 total; at least 47 tied to the outbreakYES – fifth Taco Bell outbreak state; daily updatesIN DOH / Epoch
Iowa57; about half domesticNo – IA HHS: not connected to national investigationsIA HHS / Epoch
Kansas55 (Jul 15); 37 domesticDomestic cases rising; no Kansas source foundKDHE
Kentucky192 (Jul 15); 108 confirmed; 7 hospitalizedYES – Taco Bell outbreak state; weekly updatesKY DPH / Epoch
Louisiana1–10Not declared part; not in clusterLA DOH / Epoch
MaineNo 2026 count publishedNot reported as part of the outbreakCDC
Maryland69; some travel-relatedNo – no common link identifiedMD DOH / Epoch
Massachusetts18 (normal seasonal amount)No – MA DPH: not affected by the Midwest outbreakMA DPH / Epoch
Michigan7,171 (Jul 22); 102 hospitalized (Jul 16); 23 out-of-state pendingYES – leads the outbreak; 2,408 new cases in the week to Jul 18MDHHS
Minnesota41 since May 1No – MDH: no increase over expectedMDH / Epoch
MississippiNo 2026 count publishedNot reported as part of the outbreakCDC
MissouriNo 2026 count publishedNot reported as part of the outbreakCDC
MontanaNo 2026 count publishedNot reported as part of the outbreakCDC
Nebraska49No – NE DHHS: none related to the wider outbreakNE DHHS / Epoch
NevadaNo 2026 count publishedNot reported as part of the outbreakCDC
New Hampshire1–10Cases reported; not in clusterNH DHHS / Epoch
New Jersey46 (May 1–Jul 11); within typical rangeNo – NJDOH: no clusters or outbreaksNJDOH
New MexicoNo 2026 count publishedNot reported as part of the outbreakCDC
New York517 (May 1–Jul 13) incl. NYC; CDC lists 539No – NYSDOH: not a major deviation from the normNYSDOH / Epoch
North Carolina307 (Jul 14); 13 hospitalizedNo – NCDHHS: does not appear linked to the Taco Bell outbreakNCDHHS
North DakotaNo 2026 count publishedNot reported as part of the outbreakCDC
Ohio1,316 statewide (Jul 16); 96 hospitalized. Northwest Ohio alone reports 2,029 (Jul 20)YES – Taco Bell outbreak state; state updates weeklyODH / Toledo-Lucas
Oklahoma57; 6 hospitalizedPart of the national outbreak; no Oklahoma sourceOSDH / Epoch
OregonNo 2026 count publishedNot reported as part of the outbreakCDC
Pennsylvania28; reporting is voluntaryNo – mostly travel-relatedPA DOH / Epoch
Rhode Island4 since May 1Cases reported; not in clusterRI DOH / Epoch
South CarolinaNo 2026 count publishedNot reported as part of the outbreakCDC
South DakotaNo 2026 count publishedNot reported as part of the outbreakCDC
Tennessee11–30Investigating; not in clusterTN DOH / Epoch
Texas68 (Jul 13); 15 hospitalized; all domesticMeets CDC case definition; no source identifiedTX DSHS
Utah1–10No – UT DHHS: not related to the wider outbreakUT DHHS / Epoch
VermontNo 2026 count publishedNot reported as part of the outbreakCDC
Virginia37 through Jul 4; CDC lists 61No – VDH: no evidence of a Virginia outbreakVDH
Washington27 since May 1; 5 domestic or possibly domesticNo – WA DOH: not associated with other statesWA DOH / Epoch
West Virginia195 (Jul 21); 15 hospitalized – nearly tripled since Jul 13YES – Taco Bell outbreak state; updates Tuesdays and FridaysWV Dept. of Health
Wisconsin61 (May 1–Jul 15); 11 domesticNo – WI DHS: no common food item identifiedWI DHS / Epoch
WyomingNo 2026 count publishedNot reported as part of the outbreakCDC

A word on the counts. Where a state publishes its own figure I used it, because state health departments are closer to the illnesses and update more often; where CDC’s own state table differs materially, I noted both. Update cadence is uneven — Michigan and Indiana post daily on weekdays, West Virginia Tuesdays and Fridays, Ohio and Kentucky weekly — so any national total is a blend of numbers of different ages, and sixteen states publish no 2026 count at all. The roughly 11,350 these fifty numbers add to is a floor, not a ceiling.

So, Mexico is right that there is no laboratory evidence its lettuce made anyone sick. It is right the way a supplier is right when it points to a clean test, and the way a trade group is right when it says the case rests on interviews. In a Cyclospora outbreak the laboratory almost never arrives in time, and everyone who has worked one of these knows it. The evidence here is sixteen hundred people who ate at the same restaurant, thousands more who are sick, and a paper trail that keeps arriving at the same farm in Guanajuato — the same farm as 2013. I have been doing this since 1993, and I have never once watched a positive lettuce sample rescue anyone. The people are the evidence. They always were.