Ohio Alone Has Now Reported Sixty-Four Times What It Reported in All of 2025. The Fifty-State Cyclospora Count Is 26,755, and the Federal Number Has Not Moved Since Wednesday.

The fifty state health departments now report 26,755 cases of cyclosporiasis this season, up 919 from 25,836. Two states moved and both are inside the federal outbreak. Ohio went from 4,013 to more than 4,900, and Arkansas from 205 to 237.

The Ohio figure deserves a moment. The state health department’s dashboard shows more than 4,900 cases confirmed since the beginning of the year, of which 3,399 were confirmed between July 4 and August 4 alone. In all of 2025, Ohio confirmed 76. That is not a bad year. That is sixty-four times a normal year, in a single state, in about five weeks. Ohio’s hospitalizations have also moved, from the 96 the state reported in mid-July to 172 now, and the department says more than a hundred people have been hospitalized there in the past month.

One caution for anyone reading Ohio coverage this week. The state is running two figures at once: a press-conference number of nearly 4,000 counted since June 1, and a dashboard number above 4,900 counted since January 1. They are not in conflict and they are not interchangeable. This chart has always used the calendar-year dashboard series for Ohio, so 4,900 is the like-for-like figure, and I count it at 4,900 rather than at more than 4,900, the same way I count every range on this chart at the bottom of its range.

Arkansas reported 237 laboratory-confirmed cases on Friday. CDC says 41 of them are tied to Taco Bell or the recalled Taylor Farms de Mexico lettuce, which is exactly the federal figure for Arkansas in the table below — a rare instance this summer of a state number and a federal number describing the same thing and agreeing.

The federal count has not moved since Wednesday evening. FDA and CDC both still say 6,358 illnesses, 278 hospitalizations and two deaths in fifteen states. Against the 24,539 those same fifteen states report to their own residents, that is 25.9 percent. Against the fifty-state figure it is 23.8 percent. CDC’s national surveillance page still reads 10,468 laboratory-confirmed plus more than 12,255 not confirmed, which totals 22,723 and has not changed since Tuesday. The states are now 4,032 cases ahead of that figure, a gap of nearly eighteen percent, and CDC does not update again until Tuesday.

The hospitalization picture moved with Ohio. The thirteen states that publish a hospital figure now total 680 between them. CDC’s national surveillance says 517 for the entire country. The federal figure for this outbreak is 278, and Michigan by itself reports 279. Four numbers, one disease, one week — and thirty-seven states that publish no hospital figure at all.

Here is the federal count for each of the fifteen outbreak states against what that same department tells its own residents.

StateFederal outbreak countWhat the state reportsFederal share
Michigan3,49112,48528%
Ohio6454,90013%
Missouri5681,09552%
Indiana3701,70522%
Kentucky26562043%
Oklahoma18342643%
Kansas16546136%
Illinois16499516%
Pennsylvania13282more than the state reports
West Virginia12628045%
Nebraska9291more than the state reports
Iowa8322637%
Arkansas4123717%
New Hampshire316945%
North Carolina28670%
All fifteen6,35824,53926%

And here is where all fifty stand, with the source for every number.

State2026 cases reportedRecalled lettuceWhere the number comes from
Alabama85 (Aug 3); 78 lab-confirmed; 2 hosp.; 22 tied to two Mexican-style restaurant chains, which ADPH says are not Taco Bell; 8 travelYesADPH via WAFF
Alaska5 (Jul 16)NoAlaska DOH advisory
Arizona19 (Jul 17)NoAZ DHS, via roundup
Arkansas237 lab-confirmed in 2026 (Aug 7), up 32; 41 tied to Taco Bell or recalled lettuce per CDC; ADH reports Mondays and FridaysYesArkansas DOH via KNWA
California41 provisional (Jul 14)NoCDPH NR26-024
Colorado150 (Jul 17); 4 hosp.NoCDPHE, via roundup
Connecticut35YesCT DPH press release
DelawareNo count publishedNoCDC surveillance
Florida254 since May 1 (Jul 25); 264 calendar yearYesFDOH via News4Jax
Georgia11-30 since May 1 (Jul 17); counted here at 11YesGA DPH, via roundup
HawaiiNo count publishedNoCDC surveillance
IdahoNo count publishedNoCDC surveillance
Illinois995 (Aug 4); 58 hosp.; 631 domestic, 193 travelYesIDPH via CBS Chicago
Indiana1,705 (Aug 4); IDOH posts each weekday; Allen County 290, Marion 108YesIDOH via WANE
Iowa226 in 48 counties (Jul 30), calendar year; 47 travel-relatedYesIowa HHS weekly report
Kansas461 (Jul 29); 20 hosp.YesKDHE
Kentucky620 reported (Jul 29), 274 lab-confirmed; 24 hosp.YesKDPH via WSMV
Louisiana1-10 (Jul 17); counted here at 1YesLA DOH, via roundup
MaineNo count publishedNoCDC surveillance
Maryland69 (Jul 17)YesMD DOH, via roundup
Massachusetts145 (Aug 5); 9 in May, 32 in June, 104 in JulyYesMass. DPH via CBS Boston
Michigan12,485 (Aug 6); 279 hosp.; 2 deaths; MDHHS lifted its bagged-salad advisory Aug 6 and now reports weekly on ThursdaysYesMDHHS
Minnesota41 since May 1 (Jul 17)NoMDH, via roundup
MississippiNo count publishedYesFDA distribution list
Missouri1,095 (Aug 2); doubled in one week; 90 in Boone CountyYesDHSS via KCTV5
MontanaNo count publishedNoCDC surveillance
Nebraska91 since May (Jul 20); Douglas County alone 45 (Jul 28)NoDHHS via Nebraska Examiner
NevadaNo count publishedNoCDC surveillance
New Hampshire69 (Aug 4); 32 tied to recalled lettuce at Cheshire Medical Center, 0 hosp.; 32 unknown source, 3 hosp.; 5 travelYesNH DHHS
New Jersey46 (May 1-Jul 11)YesNJDOH news release
New MexicoNo count publishedNoCDC surveillance
New York753 since May 1 (Jul 27 data); 787 calendar yearYesNYSDOH
North Carolina867 since May (Aug 4); up 149 in a week; 33 hosp.; 494 in Wake CountyYesNCDHHS dashboard
North DakotaNo count publishedNoCDC surveillance
OhioMore than 4,900 calendar year (Aug 4), up from 4,013 on Jul 30; 3,399 confirmed Jul 4-Aug 4; 76 in all of 2025; 172 hosp.; counted here at 4,900YesODH via Spectrum News
Oklahoma426 (Aug 4); 418 confirmed, 8 probable; 25 hosp.YesOSDH via KOKH
Oregon23 in 2026 (Jul 24)NoOregon Health Authority
Pennsylvania82 (Jul 29); voluntary reporting, no state dashboard; PA DOH last published 28 (Jul 16)YesPA-HAN Advisory #833
Rhode Island4 since May 1 (Jul 17)NoRI DOH, via roundup
South CarolinaNo count publishedYesFDA distribution list
South DakotaNo count publishedNoCDC surveillance
Tennessee11-30 (Jul 17); counted here at 11YesTN DOH, via roundup
Texas198 (Aug 5); 37 hosp.YesDSHS via USA TODAY
Utah1-10 (Jul 17); counted here at 1NoUT DHHS, via roundup
VermontNo count publishedNoCDC surveillance
Virginia126 total (Jul 23); 66 domestic, 31 travel, 29 pendingYesVirginia DH
Washington38 (May 1-Jul 17)NoWashington DOH
West Virginia280 (Aug 4); 20 hosp.YesWV OEPS
Wisconsin160 (Jul 29); 3 hosp.; 50 domestically acquiredYesWisconsin DHS
WyomingNo count publishedNoCDC surveillance
Nine outbreak states21,9549 
The six added Aug 52,5856 
Received the recalled lettuce26,34229 
Did not receive it41321 
All fifty states26,75550 

One closing note on what this figure is. 26,755 is a floor, not an estimate. It is the sum of what fifty health departments have published, on schedules that range from daily to never, with four states reporting only a range that I count at the bottom. It is not an estimate of how many people are sick. CDC’s own burden model assumes roughly eighty-three actual illnesses for every laboratory-confirmed case of this parasite, which applied to CDC’s 10,468 confirmed cases puts the real number near 870,000. That multiplier does not go on 26,755, because the state totals already contain the unconfirmed cases the multiplier exists to estimate. What both numbers agree on is the direction, and the direction has not changed once all summer.

This started (Well, it actually started with getting up at 4:00 AM and too much coffee) with a farm radio script ninety-second item on the Land and Livestock Report saying a produce group wants federal investigators to look beyond food as the cause of the Cyclospora outbreak. Behind it was an August 4 press release from the International Fresh Produce Association. Behind that was a federal docket — 91 FR 32972, Docket No. CDC-2026-0925, CDC’s request to keep using the Cyclosporiasis National Hypothesis Generating Questionnaire for another three years that I dug for. I found the comments.

There are three. That is the entire outside response to the federal government’s proposal to keep using, unchanged, the instrument that generates every hypothesis about where Cyclospora outbreaks come from, filed in a summer when the states have counted 25,836 Americans sick.

Who filedWho they are
International Fresh Produce AssociationMax Teplitski, Ph.D., Chief Science Officer. Filed August 3, on letterhead.
Jonathan Angel, MDA physician who treats immunocompromised patients. Wrote in support of keeping the questionnaire.
Mitchell BergerA private citizen, writing expressly in his personal capacity. Filed August 1.

No state health department commented. Not Michigan, with 12,485 cases. Not Ohio, not Indiana, not Missouri. No consumer organization, no academic epidemiologist, no laboratory, no grower. The window ran sixty-two days, from June 2 through August 3, straight through the beginning of the largest outbreak of this disease in American history, and three people found it. I lately write about this parasite most days and I missed it too.

Now the part that matters. What IFPA filed is not what IFPA announced. The August 4th press release says the association asked CDC to consider a broader range of exposure pathways. Reasonable, technical, unremarkable. The comment letter behind it opens with a recommendation headed: consider the likelihood that Cyclospora has established endemically in the United States, and the likely routes of exposure for an endemic waterborne parasite.

That sentence is not in the press release. It is not in the association’s consumer FAQ. It went where regulators read things and not where reporters do.

Let me state the argument at its full strength, because it deserves that and because the weak version of my objection would lose to it. Cyclospora cayetanensis has no host but humans. It reaches the environment through water carrying human waste — agricultural runoff, aging sewers, combined sewer overflows. The oocyst leaves the body unable to infect anyone and needs warmth and moisture over days or weeks to mature, which is why this has historically been a tropical and subtropical disease. IFPA’s question is whether a warming United States now supplies those conditions often enough to sustain a domestic cycle. It notes that CDC’s own spring-to-summer season is also the season of heavy rain and sewer overflows. And it makes a genuinely sharp point I wish I had made first: because molecular typing cannot independently identify linked clusters — a limit CDC concedes in its own notice — the interview steers the entire investigation, so if water is never asked about, it can never be ruled in or out.

IFPA then drafted nine questions and attached them. Main drinking water source. Water drunk away from home, with zip codes. Awareness of flooding, sewer overflow or a boil-water advisory. Septic system and last service date. Occupational contact with sewage treatment, stormwater, portable toilets, biosolids. Camping on private water. And recreational water contact, with a checklist that runs pool, hot tub, splash pad, lake, river, pond, irrigation canal or ditch.

Strip off the letterhead and the argument is this: twenty-five thousand Americans did not get sick from Taylor Farms lettuce. They got sick from water in Michigan. That compression is mine and not theirs — IFPA never names a body of water, and its letter is careful to frame everything as a question for CDC’s consideration. But the outbreak is half in Michigan, the checklist says lake, and I do not think I am misreading who the questions are for.

Here is the tell, and it is not in what they asked for. It is in what they did not. Nine questions, and not one of them would improve produce traceback. No brand fields. No lot or date codes. No package type, no purchase location, nothing that would move an investigator faster from a sick person to a shipment. Mitchell Berger — a private citizen with nothing to sell, writing on his own time — asked for exactly that: replace the free-text brand and lot fields with structured ones so traceback data is analyzable. The trade association whose members would have to produce those codes did not.

If your stated goal is finding the source quickly and accurately, you want both halves. You ask for the water questions and the lot-code questions. Asking only for the half that points away from your sector is the answer to the question of what this filing is.

Two other things point the same way. This is the same argument IFPA made against Michigan on July 15, when it faulted the state for discounting recreational water — and then removed from its public statement four days later. It has now been refiled somewhere permanent and almost entirely unread. And the association addressed CDC’s Items 1, 3 and 4, but not Item 2, which asks whether the burden estimate is accurate. CDC told the Office of Management and Budget this collection needs 2,800 interviews a year. The states have counted 25,836 people. Nobody on the docket said a word about it.

Now let me be careful, because the sloppy version of this critique loses. The word endemic is doing three different jobs in that letter. That this parasite turns up in American wastewater is probably true and I am not going to pretend otherwise. That there is sustained domestic transmission is unproven. That endemic American water explains this outbreak is very unlikely.

Let me say why, because I have been asked and because a one-line dismissal is not an answer. Six reasons, and the first one is the one that does the most work.

This parasite does not multiply outside a person. It has no animal reservoir, and it does not reproduce in water or soil. Every oocyst in an American lake came out of an American. An endemic cycle therefore has to be primed: you need a standing population of infected people shedding into the water before anyone can catch it from the water. Last year at this point in the season CDC had recorded 249 cases nationally. All of 2025 produced somewhere over 2,800. That is not a reservoir. Endemicity has to start somewhere, and in April of this year there was nothing here to start it with.

Water is local. This outbreak is not. Fifteen states are in the federal count. New Hampshire does not share an aquifer, a lake, a river or a utility with Michigan. To explain fifteen states with domestic water you need fifteen separate local water events arriving inside the same eight weeks, for the first time in the recorded history of this disease. That is not one hypothesis. It is fifteen coincidences. What does reach fifteen states inside eight weeks, routinely and by design, is a distribution network.

New Hampshire is the cleanest example, and the state published it. Of its 69 cases, 32 are tied to recalled lettuce served at Cheshire Medical Center, 32 have no identified source, and 5 are travel-related. The largest identified cluster in the state is a group of people who ate Taylor Farms lettuce in the same building. They did not swim in the same building.

And then there is Minnesota. If recreational water were driving this, the map would follow lakes and hot weather. Minnesota, which puts the number on its license plates, reports 41 cases. Wisconsin reports 160. Florida, where people swim year-round, reports 254. California reports 41. Michigan reports 12,485. Michigan has lakes and so does Minnesota. What Michigan had that Minnesota did not was the product.

The line the cases fall on was drawn by a shipping manifest. Of the 25,836 cases the states report, 25,423 are in the twenty-nine states that received recalled Taylor Farms product. The twenty-one states that did not receive it hold 413 between them. That is ninety-eight percent of counted illness on one side of a distribution list. I have said before that a recall footprint is not a product footprint, and the recipient states skew large, so I would not hang a case on that number alone. But no water hypothesis predicts any correlation with a shipping list at all, and this one is not subtle.

Last, climate is a trend and this is a step change. American temperatures have been climbing for decades. Endemicity does not switch on in a single summer. 2025 produced more than 2,800 reported cases in the entire year. The states have counted 25,836 in the first week of August. Warming raises a baseline slowly; across seasons you can graph. A ninefold jump in one summer is not what a baseline does. It is what a contaminated shipment does.

None of that means water never matters, and none of it is an argument against adding IFPA’s questions. Add them. Add every one of the nine. The reason this is even a live dispute is exactly the reason IFPA gave: nobody asks, so nobody knows. What I am saying is narrower and I want to be held to it — endemic American water is a reasonable thing to investigate and a poor explanation for this outbreak, in these states, on this curve, in this year.

CDC has put in print that for every United States outbreak from the mid-1990s through 2015 in which both the vehicle and its source were identified, the produce had been imported — Guatemala, then Peru, then Mexico. Endemic domestic water does not produce that pattern for thirty years. It does not produce Michigan at 12,485 while Indiana sits at 1,705 and Ohio at 4,013; Michigan’s water is not unusual; Michigan’s distribution chain was. And the biology cuts the other way from how IFPA ran it: an oocyst needs one to two weeks in the environment before it can infect anyone, so a domestic cycle is inherently slow. That is a raised background, not a curve that climbs from a standing start in mid-May and is still climbing in August.

But their hypothesis is testable, and that is the whole point of this post. If these illnesses came from local water in dozens of watersheds, the parasites should be genetically diverse and should vary by region. If they came from one contaminated shipment, they should cluster. Those are different pictures and they do not look alike.

CDC can take that picture. It has been taking it since 2020. The single published study anybody cited on this docket is a CDC paper by Ahart and colleagues on the 2021 season, which built temporal-genetic clusters from sequenced stool isolates and then ran the epidemiology behind them — testing whether a genetics-first model would work for this parasite. Dr. Angel cited it for the proposition that the questionnaire separated one apparent outbreak into two. Having read it, the engine is the sequencer, not the questionnaire. I cited that same paper myself three weeks ago and did not notice it was the answer to the question I keep asking.

Which leaves IFPA and me wanting the same document for opposite reasons. They want the genotypes published because they expect diversity. I want them published because I expect a cluster.

One of us is wrong. The data that decides it was collected months ago, sits in Atlanta, and has not been published. CDC does not have to referee an argument between a plaintiffs’ lawyer and a trade association. It has to release a table.

And if the answer comes back diverse — if the sequencing says these are dozens of separate exposures and not one shipment — then IFPA is right, I am wrong, and I will say so in this space the same day. What I am not willing to do is let a hypothesis this consequential get settled by whoever files the better letter. It should be settled by the sequencer.

The questionnaire at the middle of all of this is a public document. Ten minutes will tell you which questions a sick person gets asked and which they do not. Three people read it this summer and wrote to the government. The season closes on August 31.

Tonight I went back through all fifty state health departments, both federal case pages, and every Cyclosporafile FDA has open. Here is where each of those numbers actually stands, and then the sentence I would like to measure them against.

On July 21, at a briefing about health care fraud, Secretary Kennedy was asked about this outbreak and said the federal government had it under control. He said extensive epidemiological forensics had identified the source and that the companies involved had implemented a recall. Asked separately whether staffing and program cuts had slowed the response, he told CNBC those criticisms were invalid, that there had been no cuts to surveillance, and that the FoodNet reductions were for redundant surveillance.

Here is what the federal government’s own pages said that day, and what they say tonight.

MeasureJuly 21, 2026TonightChange
Federal outbreak count1,644 illnesses in 5 states6,358 illnesses in 15 statesup 287%
Outbreak hospitalizations94278up 196%
Outbreak deaths02two families
CDC national surveillance4,173 lab-confirmed in 41 states10,468 lab-confirmed in 47 states, plus 12,255 more not confirmedup 151% confirmed
National hospitalizations308517up 68%
What the fifty states reportno consolidated figure existed25,836the floor
FDA Cyclospora investigations4 open files7 open filesthree more since
Food named in the outbreakiceberg lettuce, no positive sampleiceberg lettuce, still no positive sampleunchanged

Every one of those movements happened after the sentence, not before it. The federal outbreak count has more than tripled. The hospitalization figure has nearly tripled. Two people have died, both in Michigan, and FDA now says on its own advisory that both had illness onset dates before the July 17 recall — which is the federal government stating that the recall arrived after the deaths it might have prevented.

I want to be fair about the part that is genuinely hard, because the argument is stronger with it than without it. This parasite is difficult. It has an incubation period of up to two weeks, a reporting lag CDC itself puts at six weeks, and no whole genome sequencing route — only targeted genotyping, which the agency’s own scientists describe as slower and less precise. None of that is anybody’s fault. A secretary saying the situation is hard would have been accurate on July 21 and would still be accurate tonight. What he said instead was that it was “under control.”

The claim about surveillance is checkable, and it did not hold up. FoodNet stopped requiring active monitoring for Cyclospora effective July 1, 2025, ten months before the first illness in this outbreak. Susan Mayne, who ran FDA’s Center for Food Safety and Applied Nutrition from 2015 to 2023, told CBS Sunday Morning that the characterization of those cuts as redundant is not accurate. A surveillance system that was switched off is not a redundant one; it is the reason the states are now the only place a national number can be assembled.

Now the piece I have not put in one place before. These are all seven Cyclospora investigations FDA has open, as the agency published them this morning. Not the one everybody is writing about. All seven.

PostedRef #PathogenProduct linked to illnessCase countStatus
8/5/20261398CyclosporaNot yet identified10Ongoing
7/22/20261392CyclosporaNot yet identified115Ongoing
7/15/20261390CyclosporaIceberg lettuce, Taylor Farms de Mexico6,358; 278 hosp.; 2 deaths; 15 statesOngoing
7/8/20261385CyclosporaNot yet identified25Ongoing
7/8/20261384CyclosporaNot yet identified18Ended
6/17/20261381CyclosporaNot yet identified2Ended
6/3/20261375CyclosporaNot yet identified8Ended
Totals7 6 with no food named6,536 illnesses 

Seven open investigations into this one parasite. Six of them have no food identified at all — six separate groups of Americans who got sick from Cyclospora and cannot be told what they ate. Those six carry 178 people. Add them to the lettuce outbreak and 6,536 people are attached to a numbered federal Cyclosporafile tonight, against the 25,836 the states report. FDA has named a food in one file out of seven.

Two rows on that table deserve to be read slowly. FDA opened file 1398 on August 5 — a brand new Cyclospora outbreak, ten people, no food identified, traceback just beginning. It opened the same day the government announced the lettuce outbreak had reached 6,358. And file 1385 went from ten cases to twenty-five, which FDA explains by saying it now includes additional illnesses based on similarities in reported exposures. That is the agency telling us it has found a common exposure pattern in a file whose food it still will not name.

Back to the states. Two moved since my last chart and both are inside the outbreak. Indiana went 1,349 to 1,705 in a single day, and Michigan went to 12,485 with its hospital count rising from 193 to 279 on its Thursday update. I re-checked Ohio, Iowa, Missouri, Oklahoma, Kansas, Illinois, Kentucky, North Carolina, West Virginia, New Hampshire, Texas, Arkansas, Massachusetts, Alabama and Wisconsin against their own departments and the same-day roundups, and none of them has posted a new figure that has reached the search index. The rest of the fifty have published nothing new since mid-July.

That Michigan hospital number deserves its own line. One state now reports 279 people hospitalized. The federal figure for the entire fifteen-state outbreak is 278. CDC’s national surveillance page says 517 for the whole country. The thirteen states that publish a hospital figure come to 604 between them, and thirty-seven states publish none at all. Four numbers, one week, one disease.

Here is the federal count for each of the fifteen outbreak states against what that same department tells its own residents.

StateFederal outbreak countWhat the state reportsFederal share
Michigan3,49112,48528%
Ohio6454,01316%
Missouri5681,09552%
Indiana3701,70522%
Kentucky26562043%
Oklahoma18342643%
Kansas16546136%
Illinois16499516%
Pennsylvania13282more than the state reports
West Virginia12628045%
Nebraska9291more than the state reports
Iowa8322637%
Arkansas4120520%
New Hampshire316945%
North Carolina28670%
All fifteen6,35823,62027%

And here is where all fifty stand, with the source for every number.

State2026 cases reportedRecalled lettuceWhere the number comes from
Alabama85 (Aug 3); 78 lab-confirmed; 2 hosp.; 22 tied to two Mexican-style restaurant chains, which ADPH says are not Taco Bell; 8 travelYesADPH via WAFF
Alaska5 (Jul 16)NoAlaska DOH advisory
Arizona19 (Jul 17)NoAZ DHS, via roundup
Arkansas205 (Aug 5); 108 in Benton County (Aug 3); ADH reports Mondays and FridaysYesArkansas DOH
California41 provisional (Jul 14)NoCDPH NR26-024
Colorado150 (Jul 17); 4 hosp.NoCDPHE, via roundup
Connecticut35YesCT DPH press release
DelawareNo count publishedNoCDC surveillance
Florida254 since May 1 (Jul 25); 264 calendar yearYesFDOH via News4Jax
Georgia11-30 since May 1 (Jul 17); counted here at 11YesGA DPH, via roundup
HawaiiNo count publishedNoCDC surveillance
IdahoNo count publishedNoCDC surveillance
Illinois995 (Aug 4); 58 hosp.; 631 domestic, 193 travelYesIDPH via CBS Chicago
Indiana1,705 (Aug 4), up 356 in a day; IDOH posts each weekday; Allen County 290, Marion 108YesIDOH via WANE
Iowa226 in 48 counties (Jul 30), calendar year; 47 travel-relatedYesIowa HHS weekly report
Kansas461 (Jul 29); 20 hosp.YesKDHE
Kentucky620 reported (Jul 29), 274 lab-confirmed; 24 hosp.YesKDPH via WSMV
Louisiana1-10 (Jul 17); counted here at 1YesLA DOH, via roundup
MaineNo count publishedNoCDC surveillance
Maryland69 (Jul 17)YesMD DOH, via roundup
Massachusetts145 (Aug 5); 9 in May, 32 in June, 104 in July; small clusters, some apparently linked to the recalled lettuceYesMass. DPH via CBS Boston
Michigan12,485 (Aug 6), up 267 in a day; 279 hosp.; 2 deaths; MDHHS lifted its bagged-salad advisory Aug 6 and moves to weekly Thursday reportingYesMDHHS via Reuters
Minnesota41 since May 1 (Jul 17)NoMDH, via roundup
MississippiNo count publishedYesFDA distribution list
Missouri1,095 (Aug 2); doubled in one week; 90 in Boone CountyYesDHSS via KCTV5
MontanaNo count publishedNoCDC surveillance
Nebraska91 since May (Jul 20); Douglas County alone 45 (Jul 28)NoDHHS via Nebraska Examiner
NevadaNo count publishedNoCDC surveillance
New Hampshire69 (Aug 4); 32 tied to recalled lettuce at Cheshire Medical Center, 0 hosp.; 32 unknown source, 3 hosp.; 5 travelYesNH DHHS
New Jersey46 (May 1-Jul 11)YesNJDOH news release
New MexicoNo count publishedNoCDC surveillance
New York753 since May 1 (Jul 27 data); 787 calendar yearYesNYSDOH
North Carolina867 since May (Aug 4); up 149 in a week; 33 hosp.; 494 in Wake CountyYesNCDHHS dashboard
North DakotaNo count publishedNoCDC surveillance
Ohio4,013 in 80 counties (Jul 30); 96 hosp. (Jul 17); Lucas County 1,241 and northwest Ohio 3,206 as of Aug 6YesODH via WOSU
Oklahoma426 (Aug 4); 418 confirmed, 8 probable; 25 hosp.YesOSDH via KOKH
Oregon23 in 2026 (Jul 24)NoOregon Health Authority
Pennsylvania82 (Jul 29); voluntary reporting, no state dashboard; PA DOH last published 28 (Jul 16); CNN carries 105 as of Aug 4YesPA-HAN Advisory #833
Rhode Island4 since May 1 (Jul 17)NoRI DOH, via roundup
South CarolinaNo count publishedYesFDA distribution list
South DakotaNo count publishedNoCDC surveillance
Tennessee11-30 (Jul 17); counted here at 11YesTN DOH, via roundup
Texas198 (Aug 5); 37 hosp.YesDSHS via USA TODAY
Utah1-10 (Jul 17); counted here at 1NoUT DHHS, via roundup
VermontNo count publishedNoCDC surveillance
Virginia126 total (Jul 23); 66 domestic, 31 travel, 29 pendingYesVirginia DH
Washington38 (May 1-Jul 17)NoWashington DOH
West Virginia280 (Aug 4); 20 hosp.YesWV OEPS
Wisconsin160 (Jul 29); 3 hosp.; 50 domestically acquiredYesWisconsin DHS
WyomingNo count publishedNoCDC surveillance
Nine outbreak states21,0679 
The six added Aug 52,5536 
Received the recalled lettuce25,42329 
Did not receive it41321 
All fifty states25,83650 

A note on what this figure is and is not. 25,836 is a floor. It is the sum of what fifty health departments have published, on wildly different schedules, four of them reporting only a range, which I count at the bottom of the range. It is not an estimate of how many people are sick. CDC’s own burden model assumes roughly eighty-three actual illnesses for every laboratory-confirmed case of this parasite, which puts the honest number somewhere near 870,000. I am not going to publish that as a count. I am publishing the floor, and the floor is 25,836.

I do not think the Secretary was lying on July 21. I think he was told the source had been identified and a recall had been issued, and he treated those two facts as the end of the problem. They are the beginning of it. A recall reaches forward only, from the day somebody notices; the people who got sick first had already eaten the evidence. Identifying a food is not identifying a cause — nobody has published a positive product sample, a water sample, an environmental assessment, or a genotype from the fields in central Mexico. And a case count that is still climbing sixteen days later is not what control looks like. It is what a lagging indicator looks like on a system that stopped watching.

The season CDC defines closes on August 31. That is twenty-five days. I would settle for someone in Washington saying, out loud, that this is not under control yet.

Put two government documents side by side, fourteen years apart, and the whole argument about transparency in public health answers itself.

On July 16, 2026, FDA published its first public advisory on the Cyclospora outbreak. The opening sentence named Taco Bell. Five states, 1,644 confirmed illnesses, onset dates reaching back to May 13. The next day the advisory named the supplier, Taylor Farms de Mexico, and a recall followed within hours. There was no confirmed positive product sample. There still is not one. The agencies named the chain and named the shipper on epidemiology and traceback alone, while the investigation was wide open and while the lettuce was still moving through the country.

By contrast, on January 19, 2012, CDC published its final report on a Salmonella Enteritidis outbreak that had sickened 68 people in Texas, Oklahoma, Kansas, Iowa, Michigan, Missouri, Nebraska, New Mexico, Ohio and Tennessee. It called the source a Mexican-style fast food restaurant chain, Restaurant Chain A. 

The public learned the name only because a reporter asked a state for its files. Dan Flynn at Food Safety News broke it on February 1, 2012, after the Oklahoma State Department of Health answered a records request with a document naming Taco Bell. 

It was not the first time, and it was not a rule. In 2010 CDC gave the same label to two concurrent Salmonella outbreaks that sickened 155 people and hospitalized 42. Yet in 2006, when E. coli O157:H7 in shredded lettuce ran through Taco Bell restaurants in the Northeast and caused eight cases of hemolytic uremic syndrome, CDC named the company outright. Same agency, same chain, same kind of outbreak, opposite decision.

The reasons offered at the time came from Bob Tauxe, then CDC’s deputy director for foodborne, waterborne and environmental diseases: name a company only when the public can act on the name, this outbreak was over, cooperation is voluntary and relations must stay cordial, and there was no written policy at all — only decades of precedent. I answered him then. Nearly every outbreak is solved after the peak, so “it is over” is available in almost every case. A company that will cooperate only inside a witness protection program is telling you something about its commitment to safe food. Bad publicity is expensive; poisoning your customers is more expensive. And a practice nobody has ever written down is not a policy. It is a habit.

Three weeks after the Restaurant Chain A report, CDC announced an ongoing investigation into twelve people in five states infected with E. coli O26 and put Jimmy John’s in the headline. Twelve sick, named while the investigation was still open. Sixty-eight sick, unnamed after it closed.

Look at what the name actually did in 2026. On July 14 the company said health officials had confirmed no link to Taco Bell or to any ingredient, supplier, restaurant or retailer, even while Detroit-area stores were posting signs saying they could not serve lettuce, pico de gallo or guacamole. FDA published two days later and named it anyway. Within a day the lettuce was out of the chain’s supply nationwide and Taylor Farms had recalled every head of iceberg it had sourced from central Mexico. That is what a name is for.

The naming kept working after the recall. On August 5 the agencies expanded the case definition to take in anyone who ate the recalled Taylor Farms lettuce, not just anyone who ate at Taco Bell, and the federal count went from 1,947 illnesses in nine states to 6,358 in fifteen. You cannot make that move unless you have already named the product. In 2012 there was no product to name, because nobody ever found it, and because nobody was ever made to explain why.

The honest objection is that 2026 fits Tauxe’s stated rule perfectly. The outbreak was ongoing and contaminated lettuce was still on shelves, so the public could act on the name. Fair enough. But 2011 was the same species of outbreak: a produce item contaminated somewhere upstream of hundreds of restaurants, pinned by epidemiology, never traced to a farm. It was declared over because the reported illnesses had stopped, not because anyone had found the source. Nobody ever did.

If that were only history I could live with it. It is not. In November 2024, eighty-nine people in fifteen states were infected with E. coli O157:H7 from romaine lettuce. Thirty-six went to the hospital. Seven developed hemolytic uremic syndrome, which is the polite clinical way of saying a child’s kidneys shut down. One person died. On January 15, 2025, CDC and FDA closed the file, recorded the vehicle as romaine from a common supplier, and issued none of the public notice the agencies had issued for every comparable romaine outbreak going back to 2010. I called what I wrote at the time CDC and FDA — Romaine Silent. The names existed the whole time. FDA released its traceback summary with the processor and the grower blacked out under the (b)(4) exemption, and Taylor Farms denied our clients’ claims from behind them. When the agency finally took the boxes off, Taylor Farms of California in Salinas was the sole processor and Anthony Costa & Sons of Soledad the single grower.

Naming is not only about stopping today’s illnesses. In most outbreaks the food is eaten long before anyone knows the source. It is about keeping a ledger, so that a buyer, a school district or a mother in the produce aisle can see which firms keep turning up in the same sad story. When this outbreak began in June, the only assembled ledger for Taco Bell sat on a blog

The same ledger exists for Taylor Farms, the supplier at the center of this summer, and it only exists because somebody wrote names in it. CNN assembled it independently this morning and counted at least five outbreaks that health officials have tied to the company over the past decade. The 2013 Cyclospora outbreak traced to salad mix from its Mexico operation. The 2015 celery and onion mix behind E. coli in Costco chicken salad. The 2024 slivered onions in the McDonald’s Quarter Pounder outbreak that sickened more than a hundred people and killed one. The 2024 romaine. And now this one. Four of those five entries are in the record because an agency, a court or a reporter published a name. The romaine entry is there because a lawyer pried it loose eighteen months after a funeral.

That reporting also supplies the piece my own argument has been missing. In an investigation published this morning, Casey Tolan, Yahya Abou-Ghazala, Curt Devine and Kyung Lah of CNN report that in the 2024 McDonald’s onion outbreak — 104 illnesses in fourteen states and one death — a former senior FDA food official described the evidence against the supplier as about as strong as such evidence gets, and said the company worked hard to keep the agency from identifying it publicly, arguing the case was not solid enough. It did not succeed there. Nobody had to make that argument about the romaine, because the agency never named anyone at all. CNN also reports that FDA concluded internally that Taylor Farms had supplied all the romaine available at every point of sale relevant to that outbreak — a finding the public saw only because lawyers for a hospitalized child obtained the agency’s report.

I am quoted in that story, and the point I made to those reporters belongs in this argument. In every one of those outbreaks the company answered by saying its own testing had found nothing. Testing done after people are already sick almost never catches the organism that made them sick, because the product that carried it has been eaten. “People eat the evidence.” A negative result on what is left in the cooler is not a finding of innocence, and it is not a substitute for a name.

That changes the shape of this. Naming is not a decision an agency makes in a quiet room by itself. There is a party on the other side of it, with counsel, pressing for the letter of the alphabet, and it is not always the government’s reticence that wins the day. Note the coincidence in the dates while you are here: in the same twelve months that CDC was calling Taco Bell Restaurant Chain A, the produce industry finished off the federal program that had been sampling fruits and vegetables around the country for pathogens since 2001. CNN reports that trade groups where Taylor Farms executives held leadership positions were among those that objected to it or pushed to have it defunded. Two different ways of not knowing, in the same year.

There is also something concrete on the table. In February, Stop Foodborne Illness filed a citizen petition asking FDA to stop treating a company’s name as confidential commercial information and, failing that, to disclose it anyway under the agency’s own duty to keep food safe. I would ask for one thing more. The petition speaks of the consumer-facing company, and in the 2024 romaine outbreak there was no such thing: no brand name appeared on that lettuce anywhere. Disclosure has to reach the processor and the grower too or produce outbreaks will keep ending in gray boxes for the simple reason that nobody’s brand was on the bag.

The July 16, 2026 advisory proves the point I have been making since 2011. No statute ever prevented CDC from naming Taco Bell in 2012, and by the agency’s own admission there was no rule at all — only precedent. Naming is a choice, it was always a choice, and this time the agencies made the better one, in the middle of an open investigation, and the republic survived. Withhold the name and every outbreak arrives looking like the first one anybody has ever had.

The petition’s lead example is the 2024 romaine outbreak, and the child it describes is my client. He was nine years old. Eighteen days in the hospital, nine of them on continuous dialysis and five more on intermittent, five transfusions, a nephrologist he is still seeing. His father spent months trying to learn the name of the company that sold the lettuce that did that to his son. He should have been able to read it in a government notice in January 2025, in plain text, with no gray boxes at all.

The documented chain, and the hypothesis this post is about.

Every time I raise irrigation water in this outbreak, the same sentence comes back at me. The water comes from deep wells. There is no Cyclospora in a well six hundred feet down. It is a good answer. It is also, on the government’s own record, an answer to a question nobody asked.

Open FDA’s environmental assessment of the Doctor Mora plant, published in November 2013 after cyclosporiasis sickened hundreds of people in Iowa and Nebraska. The report says all five assessed ranches use well water, and that the wells run roughly 650 to 1,000 feet deep with casing to the water table and cement surface seals. That is the sentence the industry quotes. Two sentences later comes the one it does not.

In 2013 three of the assessed ranches used elevated irrigation water holding ponds. Both lined and un-lined ponds were observed.

And the reason FDA gives is not a food safety reason at all. It is an electricity bill. Some of the wells lacked adequate flow rates for direct irrigation, and the power to run the well pumps was much cheaper at night than during the day. The growers therefore pumped after dark into open ponds and drew from the ponds when they needed to irrigate. At Ranch B the water from two wells was combined in a single elevated reservoir before use, and that reservoir was dosed with copper sulfate to keep the algae down. Nobody treats a sealed pipe for algae. Algae needs sunlight and open air, and if you are managing algae, you are managing an open body of surface water.

That is the whole of the deep-well defense, and it collapses on a definition rather than on a fact. Nobody has to argue that this parasite is swimming around in the Guanajuato aquifer. Water that leaves a six-hundred-foot well and then sits in an unlined pond under the sun is not well water anymore in any sense that matters to a parasitologist. The industry’s own rulebook says so. California’s leafy greens standards make growers categorize every source separately — well, reservoir, canal, municipal — and treat water from open sources such as a canal or reservoir when it is applied overhead in the twenty-one days before harvest. The distinction between a well and a pond is not something I invented for a blog post. It is a line the industry drew itself and then stopped mentioning.

Taylor Farms knew it too, and its own numbers are in the same federal report. In response to the 2013 outbreak the company ran its own assessment across the plant and thirty ranches and collected 793 samples. The categories are itemized: 81 well samples, and 48 from reservoir and storage. Six more reservoir and storage samples under environment. Three from a reservoir listed as no longer active. Ten from run-off and standing water. Eight from drain ditches. Seven from rivers, streams and canals. A company that sends technicians out to sample drain ditches and standing water is not a company that believes its irrigation water never touches the surface of the earth.

FDA did look at the ponds in 2013, and it is worth being precise about what the looking consisted of. The team walked the entire perimeter of each holding pond and found no indication of human or animal intrusion and noted that the ponds were fenced inside a fenced ranch under twenty-four-hour security. That is an intrusion check. It answers whether somebody climbed in. It does not address rain running off surrounding ground into an open pond, it does not address birds, and it does not address what an unlined pond exchanges with the soil water around it. The report’s one sentence about flooding is specific: the team found no indication of flooding or other potential irrigation water contamination at any of the wells. The wells. The ponds are not in that sentence.

So, what does 2026 look like?  So far, silence.

Now the part where I am speculating.

The first half of 2026 was the wettest in Guanajuato in nearly a decade. The Servicio Meteorológico Nacional logged 10.9 inches of rain accumulated by mid-year, with June the heaviest month at up to 7.6 inches, a figure the state had not seen since around 2018. The rainy season opened in the middle of May. The state’s own water engineers warned before it started that June would be the wettest month, and warned specifically about standing water, urban flooding and arroyos overflowing their banks. CONAGUA had forecast in April that El Niño would push 2026 past 2025, which was already one of the wettest years of the decade.

Now put that beside the illness curve. Back the six-week reporting lag off the late-June surge in reported cases and the excess illnesses in this outbreak begin in the back half of May. The rains began the week of May fourteenth. June, the month the state water engineers said would be the wettest, is the month the reporting exploded.

That is a temporal correlation and nothing more. Statewide rainfall is not Doctor Mora rainfall, and the station data that would settle it sits with CONAGUA. I have not found a single published report of a sewage system overflowing or a treatment plant bypassing in Doctor Mora or San José Iturbide this spring. I am not going to claim one happened. What I will say is that perhaps nobody has looked, and that the absence of a news story about a rural Mexican sewer is not evidence about a rural Mexican sewer.

Here is why the mechanism fits, though, and it fits better than anything else. This parasite has one known reservoir, and it is human feces. FDA’s own report says so in its second paragraph. Heavy rain is how human waste gets out of septic tanks and sewers and into arroyos and onto open ground — that is not a Mexican problem, it is a plumbing problem, and it happens in Iowa. An unlined elevated holding pond is a catchment. And then comes the detail that makes a pond different from every other point on this map: the oocysts shed in faces are not infectious when they leave the body. They need one to two weeks somewhere warm, between 72 and 90 degrees Fahrenheit, to sporulate. Northeastern Guanajuato sits inside that temperature window in every month of the year.

A holding pond is warm, still, open and full for weeks at a time. It is not merely a place where contamination could enter the irrigation system. It is a place with exactly the residence time and exactly the temperature this organism requires to become infectious. If you were designing an incubator for Cyclospora and then attaching it to a lettuce field, you would build something that looked a great deal like an unlined irrigation reservoir in central Mexico in June.

The plant is at kilometer 16 of the Doctor Mora to San Miguel de Allende highway. Seven hundred and seventy-six feet away sits Balneario Las Fajanas, a public thermal bathing complex the state of Guanajuato lists in its own tourism guide, with pools, water slides, grills, palapas and restrooms, open every day of the week. I have written about that before. Within nine miles there is a second bathing complex, a water park, two municipal treatment works and two towns. What I cannot show you is the thing this post is actually about, because the five ranches in FDA’s report are lettered A through E and their locations have never been published. The ponds are somewhere in that landscape and nobody outside the company and two governments knows where.

None of this is a novel theory. The Center for Produce Safety and USDA have been funding work on exactly this premise — faulty septic systems, compromised sewer pipes and treated effluent reaching surface water used to irrigate food crops. A two-year study in southeast Georgia confirmed the parasite by sequencing in nine percent of municipal wastewater sludge samples. In 2020 FDA came closer to proving it than it ever has, sampling a regional canal in Florida during the Fresh Express bagged salad outbreak and finding the parasite at two points, north and south of where the suspect farm drew canal water for irrigation. The genetic typing was not mature enough to match those finds to patients, and the investigation closed unresolved. And in 2015 FDA published an import alert on Puebla cilantro describing human feces and toilet paper in growing fields, and wash water vulnerable to sewage, at eight of eleven farms inspected.

There are four documents that would settle most of this and none of them requires anyone to speculate. The CONAGUA station records for Doctor Mora and San José Iturbide, which would say what rain actually fell where. The municipal discharge and bypass records held by the state water commission and the San José Iturbide utility, which would say whether anything overflowed. The locations, linings and sampling histories of the irrigation holding ponds serving the 2026 crop — Taylor Farms has these, and FDA has seen their 2013 ancestors. And the answer to the question FDA asked Taylor Farms thirteen years ago, in recommendation two of that same report: is Cyclospora a reasonably likely hazard in the Guanajuato growing region, and if it is, what happened to the wash step?

Twenty-two thousand people have been counted this season by their own state health departments. Two of them are dead. I am not in a position to tell you that a pond did this, and I have tried to be careful above about the difference between what a federal report from 2013 says and what I think it implies. But when the industry answers a question about irrigation water with the word well, somebody should point out that FDA already wrote down what happens to the water after it leaves the well. It goes into a pond. Sometimes the pond has no liner. And it sits there in the sun, in a valley where the temperature never leaves the range this parasite needs, until somebody opens a valve.

CDC named the source of the current Salmonella outbreak today — jalapeños from a grower in Sinaloa, Mexico, moved into the United States by Coast Citrus Distributors, 345 people sick (most in Minnesota and Colorado) in 27 states with 36 hospitalized. Chipotle and QDOBA pulled product.

It is not surprising. Fresh hot peppers and Salmonella have a documented relationship going back nearly twenty years, and every box of them runs through Mexico. Here is the record.

Start with the one everybody half-remembers. In the spring and summer of 2008, Salmonella Saintpaul sickened 1,442 people across 43 states, the District of Columbia and Canada, hospitalized at least 286, and may have contributed to two deaths. It was, at the time, the largest foodborne outbreak in the United States in more than a decade. Investigators spent months on raw tomatoes and destroyed the domestic tomato market doing it — growers put losses in the hundreds of millions. The New England Journal of Medicine account is the one to read: eating at a Mexican-style restaurant, eating pico de gallo, and having a raw jalapeño in the house all tracked with illness; jalapeños were implicated in every restaurant cluster with an identified ingredient; and the outbreak strain was recovered from a jalapeño at a produce importer in McAllen, Texas, from a jalapeño in a patient’s home in Montezuma County, Colorado, and from irrigation water and a serrano pepper on a farm in Mexico. Tomato traceback never converged on anything.

By July of that year FDA was advising consumers outright not to eat fresh jalapeños and serranos grown in Mexico, and Agricola Zaragoza of McAllen had recalled its jalapeños after one tested positive for the outbreak strain. Eighteen years later the shape of the thing is identical: a Mexican grower, a Texas or California importer, and a warning that arrives after the crop has been eaten.

The part of 2008 that deserves more attention than it gets came afterward, and it came from the Associated Press rather than from any agency. FDA’s food safety chief, Dr. David Acheson, told reporters that summer that the agency had not typically seen problems with peppers. The AP then went into FDA’s own border records and found that peppers and chilies had been the most frequently rejected Mexican crop for the preceding year — 158 intercepted shipments of fresh and dried chilies, eight percent of them carrying Salmonella, and in the first seven months of 2008 alone, 88 shipments turned away with ten percent contaminated. Fresh peppers specifically were being stopped as the outbreak ran: six separate shipments of fresh jalapeños and serranos were held in July after inspectors found Salmonella, and that August the agency added a dozen Mexican growers or distributors to its import alert list. The information was inside the building the entire time. Nobody had connected the rejection data to the illness data.

Eight years later it happened again on a smaller scale, and this time the sequence is almost unbelievable. In May through July 2016, 32 people in nine states were infected with a rare strain of Salmonella Anatum linked to imported hot peppers. In April 2016 — before a single case had been identified — FDA had already isolated that strain from an Anaheim pepper during routine produce sampling. The sample came from a consolidator and grower that supplied two of the restaurants outbreak patients later reported visiting. Whole genome sequencing showed the pepper isolate and 19 clinical isolates differed by zero to three SNPs. The agency had the organism in hand before the outbreak was recognized, and the match was only made in hindsight.

That 2016 investigation also documented the problem that is on display again right now. Investigators had to work from restaurant recipes because pepper varieties are nearly impossible for a sick person to identify once the pepper has been diced into salsa. Anaheim, jalapeño, poblano, serrano — a customer eating a burrito cannot tell you which one they ate, or whether they ate one at all. Add the fact that Mexican-style meals share a dozen common raw ingredients, and you get exactly what CDC published this week: a cluster analysis listing jalapeño peppers alongside red onion, cilantro and avocado.

Then there is FDA’s own prevalence data, which the agency generated and published, and which reads today like a warning nobody acted on. Under the FY2016–2017 hot pepper sampling assignment, FDA found Salmonella in 2.61 percent of hot peppers grown in Mexico — 29 positives out of 1,112 samples. Hot peppers from the Dominican Republic came back at 8.33 percent, seven positives out of 84. The Dominican result was strong enough that FDA ran intensified screening, got the same answer, and put two Dominican firms on Import Alert 99-23 for detention without physical examination. 

In the same date, one in every thirty-eight hot peppers FDA pulled from Mexican shipments carried Salmonella. That is not an anomaly, an outlier lot, or a bad season. That is the baseline condition of a commodity Americans eat raw.

Three. That is how many recognized multistate Salmonella outbreaks have been attributed to fresh hot peppers in the United States in twenty years: 2008, 2016, and this one. Three outbreaks, against a commodity that FDA’s own sampling says carries Salmonella at 2.61 percent, imported by the hundreds of millions of pounds a year, and eaten raw.

Those two facts cannot both be describing reality. Either peppers are contaminated at one in thirty-eight and almost never make anyone sick — which is not how Salmonella works — or we are catching a small fraction of the illnesses they cause. The 2016 investigation tells you which. That outbreak was solved because a laboratory happened to have sequenced a pepper two months earlier; without that isolate sitting in PulseNet, thirty-two people in nine states would have been an unsolved cluster and the peppers would have finished the season. The 2008 outbreak was solved after investigators spent a summer on the wrong commodity. The number of pepper outbreaks in the record is not a measure of how often peppers make people sick. It is a measure of how often we manage to prove it.

The reasons this commodity behaves the way it does are not mysterious. Fresh chilies are grown outdoors in warm climates, irrigated with surface water, harvested by hand, and eaten raw. There is no cooking step, no pasteurization, and no wash that reliably removes Salmonella from the crevice where the stem meets the fruit. Mexico supplies the overwhelming majority of the fresh jalapeños and serranos consumed in this country. The 2008 investigation found the outbreak strain in irrigation water on a Mexican farm. Sinaloa in 2026 is the same story with a different state and a different serotype.

The distribution layer makes it worse. Peppers move through consolidators — the 2016 investigation used exactly that word — who aggregate fruit from many small farms into a single lot. One contaminated field can seed a lot that reaches hundreds of restaurants in a dozen states, and traceback from the plate back through the consolidator to the field is slow enough that the crop is eaten before anyone finishes. Coast Citrus is playing that role in 2026. Agricola Zaragoza played it in 2008.

And the epidemiology is genuinely hard, which is worth saying honestly. Peppers hide in salsa. People do not remember eating them. Mexican-style restaurant meals bundle five or six raw produce items together, so the questionnaire cannot separate them. Investigators in 2008 chased tomatoes for months for reasons that made sense at the time and were wrong. Anyone tempted to be glib about this week’s pace should read the 2016 MMWR, which says out loud that the pepper hypothesis only came together because a laboratory match arrived to break the epidemiologic tie.

In today’s outbreak there is a recall of sorts, and it is worth being precise about what kind. FDA recommended that Coast Citrus Distributors pull the product; the company agreed to recall the remaining implicated product and is contacting affected customers. That is a recall of inventory, not of exposure — the peppers that sickened 345 people were eaten in June and early July and are long gone. It is also a recall conducted by private customer notification. There is no posted company announcement, no lot codes, no ship dates, and no consignee list. A restaurant that bought these peppers from a secondary distributor rather than from Coast Citrus directly has no way to find that out on its own. Here the advice to consumers is to ask the store where the peppers came from — which is to say, run the traceback yourself.

None of the difficulty above is new information, and that is the point. FDA has its own sampling data showing 2.61 percent Salmonella prevalence in Mexican hot peppers and 8.33 percent in Dominican ones. It has the 2008 outbreak, the largest of its era, with the strain pulled from irrigation water on the farm. It has the 2016 outbreak in which its own laboratory held the outbreak strain before the outbreak existed. It has border rejection records that the Associated Press could analyze, and the agency apparently could not.

In 2026 a grower in Sinaloa shipped jalapeños that put thirty-six people in the hospital across twenty-seven states, and the response was assembled in public, in pieces, over roughly seven weeks, with a distributor named on August 5 and the grower still unnamed tonight.

Twelve days after its last update, FDA posted a new advisory this evening that said nine-state outbreak now says fifteen. The total is 6,358 illnesses, up from 1,947. Hospitalizations are 278, up from 98. And after eleven days in which every federal page said zero, the deaths are on it: two, both in Michigan.

The number that matters most, though, is not any of those. It is the sentence explaining them.

FDA says that because of additional interview data, CDC expanded its confirmed cases to include people who reported exposure to Taco Bell or recalled Taylor Farms de Mexico iceberg lettuce. Until tonight the federal definition was Taco Bell exposure and nothing else. I wrote this morning that if New Hampshire joined this outbreak on the thirty-two illnesses it has tied to a hospital cafeteria in Keene, the case definition would have widened past a single restaurant chain for the first time since July 14, and that CDC could settle it in one sentence. That is the sentence. This is no longer a Taco Bell outbreak. It is a lettuce outbreak that ran through Taco Bell too.

You can see it in FDA’s own lists. Its restaurant line says the Taco Bell locations that received recalled lettuce include at least thirteen states — Arkansas, Iowa, Illinois, Indiana, Kansas, Kentucky, Michigan, Missouri, Nebraska, Ohio, Oklahoma, Pennsylvania and West Virginia. The outbreak has fifteen. The two that are in the outbreak and not on that list are New Hampshire and North Carolina, which are precisely the two states whose illnesses never ran through that chain. New Hampshire’s cases came out of a hospital cafeteria.

FDA also says, twice and without being asked, that many of these illnesses began before the July 17 recall. On the deaths it goes further: based on information Michigan provided, both people who died had illness onset dates prior to the recall. That is the federal government stating on its own advisory that the recall arrived after the deaths it might have prevented.

Here is the federal count for each of the fifteen states, alongside what that same state health department is telling its own residents this evening.

StateFederal outbreak countWhat the state reportsFederal share
Michigan3,49112,21829%
Ohio6454,01316%
Missouri5681,09552%
Indiana3701,34927%
Kentucky26562043%
Oklahoma18342643%
Kansas16546136%
Illinois16499516%
Pennsylvania13282more than the state reports
West Virginia12628045%
Nebraska9291more than the state reports
Iowa8322637%
Arkansas4120520%
New Hampshire316945%
North Carolina28670%
All fifteen6,35822,99728%

The first is North Carolina: two. The federal outbreak count for North Carolina is two people. North Carolina tells its own residents 867, and its dashboard still says the increase in the state does not appear to be associated with the Taco Bell outbreak. Both of those statements are now on government websites at the same time.

The second runs the other way, and it is the more useful one. In Nebraska and Pennsylvania, the federal number is now larger than the state number — 92 against 91, and 132 against 82. Neither state was undercounted by Atlanta. Both were undercounted by themselves. Nebraska’s figure is a spokesman’s number from July 20 that nobody has refreshed, and Pennsylvania publishes no dashboard at all and takes cyclosporiasis reports voluntarily. When the federal government can find more sick Pennsylvanians than Pennsylvania can, the 

The fifty-state floor stands at 25,213 tonight, across every state health department that publishes anything. The hospitalization picture is stranger than it was this morning. FDA now says 278. CDC’s national surveillance page says 517. The thirteen states that publish a number of their own come to 518 between them. Three federal-adjacent figures, three different answers, same week — and thirty-seven states publish no hospitalization figure at all.

One more thing changed quietly. FDA’s distribution list grew from twenty-seven foodservice states to twenty-eight, and the state it added is New York. New York has been reporting 753 cases while sitting outside every distribution list published so far. It is inside one now. The recall footprint is twenty-nine states counting the Walmart retail list, and the recall notice itself has not otherwise moved.

And one thing did not change at all. The outbreak still officially begins on June 22. FDA’s own July 16 advisory reported 1,644 illnesses with onset dates running back to May 13. The June 22 floor has now survived three updates and a full expansion of the case definition, and those six weeks of illness are still outside the outbreak. Nobody has explained where they went.

Where each of the 50 states stands this evening, with the source for every number. Ten rows changed: Alabama, Arkansas, Illinois, Kentucky, Massachusetts, Michigan, New Hampshire, North Carolina, Texas and West Virginia.

State2026 cases reportedRecalled lettuceWhere the number comes from
Alabama85 (Aug 3); 78 lab-confirmed; 2 hosp.; 22 tied to two Mexican-style restaurant chains, which ADPH says are not Taco Bell; 8 travelYesADPH via WAFF
Alaska5 (Jul 16)NoAlaska DOH advisory
Arizona19 (Jul 17)NoAZ DHS, via roundup
Arkansas205 (Aug 5); 108 in Benton County (Aug 3); ADH reports Mondays and FridaysYesArkansas DOH
California41 provisional (Jul 14)NoCDPH NR26-024
Colorado150 (Jul 17); 4 hosp.NoCDPHE, via roundup
Connecticut35YesCT DPH press release
DelawareNo count publishedNoCDC surveillance
Florida254 since May 1 (Jul 25); 264 calendar yearYesFDOH via News4Jax
Georgia11-30 since May 1 (Jul 17)YesGA DPH, via roundup
HawaiiNo count publishedNoCDC surveillance
IdahoNo count publishedNoCDC surveillance
Illinois995 (Aug 4); 58 hosp.; 631 domestic, 193 travelYesIDPH via CBS Chicago
Indiana1,349 (Aug 3); Allen County 290, Marion 108YesIDOH via WRTV / WISH-TV
Iowa226 in 48 counties (Jul 30), calendar year; 47 travel-relatedYesIowa HHS weekly report
Kansas461 (Jul 29); 20 hosp.YesKDHE
Kentucky620 reported (Jul 29), 274 lab-confirmed; 24 hosp.YesKDPH via WSMV
Louisiana1-10 (Jul 17)YesLA DOH, via roundup
MaineNo count publishedNoCDC surveillance
Maryland69 (Jul 17)YesMD DOH, via roundup
Massachusetts145 (Aug 5); 9 in May, 32 in June, 104 in July; small clusters, some apparently linked to the recalled lettuceYesMass. DPH via CBS Boston
Michigan12,218 (Aug 5); up 710 in one day; 193 hosp. (Jul 30); 2 deathsYesMDHHS / Reuters
Minnesota41 since May 1 (Jul 17)NoMDH, via roundup
MississippiNo count publishedYesFDA distribution list
Missouri1,095 (Aug 2); doubled in one week; 90 in Boone CountyYesDHSS via KCTV5 / STLPR
MontanaNo count publishedNoCDC surveillance
Nebraska91 since May (Jul 20); Douglas County alone 45 (Jul 28)NoDHHS via Nebraska Examiner / WOWT
NevadaNo count publishedNoCDC surveillance
New Hampshire69 (Aug 4); 32 tied to recalled lettuce at Cheshire Medical Center, 0 hosp.; 32 unknown source, 3 hosp.; 5 travelYesNH DHHS / NHPR
New Jersey46 (May 1-Jul 11)YesNJDOH news release
New MexicoNo count publishedNoCDC surveillance
New York753 since May 1 (Jul 27 data); 787 calendar yearNoNYSDOH
North Carolina867 since May (Aug 4); up 149 in a week; 33 hosp.; 494 in Wake CountyYesNCDHHS dashboard
North DakotaNo count publishedNoCDC surveillance
Ohio4,013 in 80 counties (Jul 30); 96 hosp. (Jul 17); ODH puts Lucas Co. at 554, the county health dept. at 1,218 (Aug 3)YesODH via WOSU / Toledo Blade
Oklahoma426 (Aug 4); 418 confirmed, 8 probable; 25 hosp.YesOSDH via KOKH
Oregon23 in 2026 (Jul 24)NoOregon Health Authority
Pennsylvania82 (Jul 29); voluntary reporting, no state dashboard; PA DOH last published 28 (Jul 16)YesPA-HAN Advisory #833
Rhode Island4 since May 1 (Jul 17)NoRI DOH, via roundup
South CarolinaNo count publishedYesFDA distribution list
South DakotaNo count publishedNoCDC surveillance
Tennessee11-30 (Jul 17)YesTN DOH, via roundup
Texas198 (Aug 5); 37 hosp.YesDSHS via USA TODAY
Utah1-10 (Jul 17)NoUT DHHS, via roundup
VermontNo count publishedNoCDC surveillance
Virginia126 total (Jul 23); 66 domestic, 31 travel, 29 pendingYesVirginia DH
Washington38 (May 1-Jul 17)NoWashington DOH
West Virginia280 (Aug 4); 20 hosp.YesWV OEPS
Wisconsin160 (Jul 29); 3 hosp.; 50 domestically acquiredYesWisconsin DHS
WyomingNo count publishedNoCDC surveillance
Nine outbreak states20,4449 
Received the recalled lettuce24,04728 
Did not receive it1,16622 
All fifty states25,21350 

One more number, because 25,213 is a floor and not an estimate. In 2011 Elaine Scallan and seven colleagues at CDC published the agency’s foodborne burden model in Emerging Infectious Diseases, and its Table 2 still carries the only published United States burden estimate specific to Cyclospora. The underdiagnosis multiplier for this parasite is 83.1. For every laboratory-confirmed case, CDC’s own model assumes about eighty-three people actually got sick. Applied where it belongs, to the 10,468 laboratory-confirmed cases CDC reports this season, it puts the real number near 869,891. It does not go on 25,213. The state totals already include the cases the multiplier exists to estimate, so multiplying those counts the same people twice.

That is arithmetic rather than a measurement, and it should be read as a ceiling. The model’s own credible interval for Cyclospora runs from 137 to 37,673 domestically acquired foodborne illnesses a year, a 275-fold spread and the least precise line in the table. The 83.1 was built from data gathered before multiplex PCR panels carried a Cyclospora target at all, which happened in 2014, and an outbreak that has doctors ordering the test drives the true multiplier down further. Nobody has published an updated one; the 2025 revision of that paper covers seven pathogens and this parasite is not among them. What the figure is good for is the shape of the problem. The same table puts Listeria at 2.1, because severe illness gets diagnosed and a miserable, self-limiting one does not.

CDC posted an outbreak investigation page this evening. The numbers are 345 people sick in 27 states, 36 hospitalized — twelve percent of the 291 for whom that information exists — and no deaths. Illnesses began between June 19 and July 20. Of 191 people interviewed, 177 reported eating at a Mexican-style restaurant, Chipotle and QDOBA among them, with meal dates from June 14 to July 14. Investigators identified twenty-seven separate illness clusters at Chipotle and QDOBA locations across seven states.

And then the sentence everyone has been waiting three weeks for. Epidemiologic and traceback data show that jalapeño peppers from Sinaloa, Mexico, distributed by Coast Citrus Distributors, may be contaminated with Salmonella Javiana and are making people sick.

Now hold that up against what the FDA outbreak table says as I write this. Reference #1395, Salmonella Javiana, product linked to illnesses: Not Yet Identified. Total case count: 212. The recall column is empty. The on-site inspection column is empty. The page was last modified Tuesday morning at 9:30. CDC named a distributor and a growing region a day and a half later, and the federal table that most of the food industry actually watches has not moved a pixel.

That is a 133-case gap and a 25-state gap between two agencies working the same outbreak.

CDC published the state-by-state breakdown along with it.

StateIllStateIll
Alabama1North Carolina3
Arkansas1North Dakota1
California1Nebraska5
Colorado110Ohio2
Georgia6Oklahoma8
Illinois30South Carolina5
Indiana6Tennessee3
Kansas13Texas3
Kentucky1Utah1
Louisiana1Virginia2
Michigan4Washington1
Minnesota110Wisconsin9
Missouri7Wyoming6
Montana5  

Two numbers jump off that table, and they are the same number. Minnesota 110. Colorado 110. Those two states hold 220 of the 345 cases — sixty-four percent of a twenty-seven-state outbreak. Illinois is third with 30. Everything else is in single or low double digits, and eight states report exactly one case.

Now look at which states are high and which are low. California, with thirty-nine million people and Chipotle and Qdoba locations in nearly every city of size, reports one case. Texas reports three. Ohio reports two. Wyoming, with fewer than six hundred thousand residents, reports six. Montana reports five. Kansas reports thirteen — more than California, Texas, Ohio, Virginia and Washington combined. New York, Florida, Pennsylvania, New Jersey, Massachusetts and Arizona do not appear at all.

Nobody should read that as a map of where the peppers went, because it is not one. It is a map of which state public health laboratories sequence aggressively, interview quickly, and report what they find. Minnesota and Colorado sit at the top of this list for the same reason they were the first two states to say anything in public: they look. Somebody who ate the same pepper in a state that does not look is not in this table, and not being counted is not the same as not being sick.

Now the part that should bother you more than the arithmetic. CDC’s advice to businesses is to check their inventory for the recalled jalapeño peppers and not sell or serve them. I have looked for that recall. It is not in FDA’s recall column for this investigation. I cannot find a recall notice for Coast Citrus Distributors or for anybody else in this outbreak. Businesses are being told to pull a recalled product for which there is no published notice, no lot codes, no shipping dates, no brand names, and no distribution list. A restaurant manager who reads the CDC page tonight and goes to the walk-in has nothing to compare a case against.

And the grower still has no name. Read CDC’s own sentence carefully: FDA conducted a traceback and a common grower of jalapeños in Sinaloa that supplies Coast Citrus Distributors was identified as the likely source. Identified. Not named. Somebody has that name in a file right now. It has been in that file long enough for two national restaurant chains to have already pulled product on the strength of it.

I have written three posts in three days about this outbreak, and the through-line has never changed.

On August 3 the public count was 212 with no product named, and I laid out twenty-five years of Javiana history pointing straight at produce. On August 4 Chipotle pulled jalapeños after 110 fell ill in Minnesota and both federal agencies said nothing. That evening the scoreboard read Minnesota 110, Colorado 110, FDA 212, two states adding up to more than the national count. This afternoon Bloomberg reported that Qdoba had pulled jalapeños from more than eight hundred restaurants.

In seventy-two hours the public number went from 212 to 345 and the public state count went from two to twenty-seven. Almost none of that is new illness. The last onset date in CDC’s own table is July 20 — sixteen days ago. These people were already sick. What changed was disclosure, and it changed only after two restaurant companies and two Bloomberg reporters forced the issue.

A few things in the CDC data deserve more attention than they will get.

The commonly reported ingredients in those twenty-seven clusters were jalapeño peppers, red onion, cilantro, and avocado. Jalapeños are the lead, and the traceback supports it. But three other raw items are still sitting in that sentence, and anyone who lived through 2008 knows what it costs to lock onto one commodity too early — or, for that matter, onto the wrong one. Investigators chased tomatoes for months that summer while 1,442 people got sick and the domestic tomato market was destroyed, and the New England Journal of Medicine account later established that jalapeños were implicated in every restaurant cluster with an identified ingredient, with the outbreak strain recovered from a jalapeño in Texas and from irrigation water and a serrano pepper on a Mexican farm.

Two isolates carry resistance. One is predicted resistant to ampicillin, ceftiofur, ceftriaxone, streptomycin, sulfisoxazole and trimethoprim-sulfamethoxazole, and nonsusceptible to ciprofloxacin. Another is predicted resistant to azithromycin. Most people with Salmonella recover without antibiotics, but the ones who need them are the ones already in trouble, and in this outbreak thirty-six people were sick enough to be admitted. That detail belongs in front of treating physicians, not buried in a laboratory section.

The count is going up. CDC says so itself: it takes three to four weeks to determine whether a sick person belongs to an outbreak, and many people never get tested at all. The 345 is a floor.

Here is what should happen tomorrow morning.

Name the grower. FDA has the name. The agency’s own standard is that it will not name a specific product until there is sufficient evidence to implicate it — and CDC just published the implication. Whatever threshold FDA set for itself has been met by its sister agency in public.

Publish the recall. If jalapeños have been recalled, there must be a notice with firm names, lot codes, ship dates and consignees. If they have not been recalled, then CDC should not be telling businesses to check for recalled product, and FDA should explain why a product identified as the likely source of 345 illnesses is still legally in commerce.

Publish the distribution list. Chipotle and QDOBA are two customers of one distributor. Coast Citrus serves a great many more. Every one of them is entitled to know today, and so is every person who ate at one of them in June.

Update the table. Ref #1395 saying “Not Yet Identified” tonight is not a technicality. That table is what buyers, brokers, retailers and state agencies check. Leaving it stale while CDC names a distributor is how product keeps moving.

One last thing, because it is the only genuinely good news here. This outbreak’s first illness began June 19. A distributor and a growing region were named on August 5 — about seven weeks. In 2008 the same commodity, the same country, and a nearly identical epidemiologic picture took the better part of a summer and cost the tomato industry hundreds of millions of dollars for nothing. Faster is real progress and the people who did that work deserve to hear it said.

It is still not fast enough, and it is still not finished, because a grower in Sinaloa whose peppers put thirty-six people in the hospital has a name, and tonight the only people who know it are the ones who do not have to say it.

Qdoba Restaurant Corp. has pulled jalapeños from more than 800 locations and is cooperating with federal authorities investigating a Salmonella outbreak that has sickened hundreds of people across the country. The company has not said when the peppers come back or who provided them.

That is Bloomberg, this afternoon, by Daniela Sirtori and Jessica Nix. A tip of the pen to both of them, because they are the reason anyone outside the investigation knows there is a second chain.

Here is what the public record said before they filed. On Tuesday the Minnesota Department of Health named jalapeños as the suspected vehicle in a Salmonella Javiana outbreak and put its own count at 110. Carlota Medus, the senior epidemiologist supervisor in the state’s foodborne diseases unit (a.k.a “Team D”), said the food that made people sick was served at other restaurants as well. Laurie Schalow, Chipotle’s chief corporate affairs and food safety officer, said the peppers went to several food service retailers across multiple states. Colorado said it had 110 cases associated with the same outbreak and declined to say what they ate or where. FDA said it opened a traceback of multiple ingredients on July 22, carried the national count at 212, listed the source as not yet identified, and said it would say more if and when there was an actionable public health update.

Every one of those statements is true. Not one of them names anybody. “Other restaurants.” “Several food service retailers.” “Multiple states.” A person who ate a burrito in late June and then spent three days on a bathroom floor cannot do a single thing with that vocabulary. She cannot check whether she ate at one of the restaurants. She cannot tell her doctor what to test for. She cannot warn her sister.

Two reporters put one name on it, and the shape of the outbreak changed.

Consider the arithmetic. Chipotle pulled from the locations that received a common lot. Qdoba pulled from more than eight hundred. That is not solely a Minnesota problem, and it is not solely a Chipotle problem. It is a load of peppers that went into a national distribution system and came out the other side in thousands of kitchens, and the only reason we can see two of them is that a company confirmed it to a reporter who asked.

The question I want answered next is how Qdoba found out. If a distributor called Qdoba in July when the trace began, then the supply chain worked and the only failure is that the public was kept outside it. If Qdoba found out the way I did — by reading about Chipotle on Tuesday and going to look in its own coolers on Wednesday — then the notification system did not work at all, and every other buyer of that lot is currently in the same position Qdoba was in on Monday: serving the product and not knowing. Those are very different stories with very different consequences, and the answer exists today in somebody’s email.

We have run this exact play before. In 2008, Salmonella Saintpaul sickened 1,442 people in 43 states, the District of Columbia and Canada. Investigators chased raw tomatoes for months, wrecked the domestic tomato market, and only later established through the New England Journal of Medicine account that jalapeños were implicated in every restaurant cluster with an identified ingredient, with the outbreak strain recovered from a jalapeño in Texas and from irrigation water and a serrano pepper on a Mexican farm. The lesson everyone claimed to take from 2008 was that traceback has to move faster than the produce does. Eighteen years later, the federal traceback opened July 22 and the public got a name on August 5 from Bloomberg.

The recordkeeping rule that was supposed to fix precisely this — FSMA Section 204, the Food Traceability Rule, which would require lot-level records for leafy greens and fresh peppers among other high-risk foods — has been pushed to 2028. The industry asked for the delay. It got it. This is what the delay buys: a grower nobody can name, a distributor nobody can name, a retail list nobody will publish, and two chains that had to find the lot in their own coolers one at a time.

Somebody knows the grower’s name. Chipotle knew it well enough on Tuesday to stop buying. Qdoba knew it well enough by Wednesday to pull eight hundred restaurants. FDA has known it since the traceback opened two weeks ago. The only party still in the dark is the one that got sick.

FDA should publish the grower, the distributor, and the list of retailers that received the lot, today. Not because it makes an actionable consumer recommendation in the agency’s preferred sense of that phrase, but because eight hundred restaurants is an actionable consumer recommendation, and it took two reporters to produce it.

Daniela Sirtori and Jessica Nix did this week what the federal food safety apparatus is funded to do. They should not have had to.

At six o’clock last night the fifty state health departments were reporting 23,295 cases of cyclosporiasis. This morning they are reporting 25,213. Ten states moved. Seven of them sit inside the fifteen-state outbreak the Washington Postreported yesterday afternoon, and three of them — Alabama, Massachusetts and Texas — do not.

No federal page says fifteen states. CDC’s outbreak page and its investigation update both still read nine states and 1,947. FDA’s advisory is still titled as an investigation of a nine-state outbreak and is still stamped July 24 with 98 hospitalizations and zero deaths. Twelve days. NBC News confirmed the six-state expansion Wednesday morning off its own source, so two national newsrooms have now reported it independently. The government has not.

Here is where the fifteen states in the outbreak stand this morning, and what the federal government says about the same fifteen. The nine were named by CDC. The six come from the Post.

State2026 cases reported by the stateAdded to the federal outbreak
The nine already on CDC’s outbreak page  
Illinois995July 24
Indiana1,349July 18
Kansas461July 24
Kentucky620July 14
Michigan12,218July 14
Ohio4,013July 14
Oklahoma426July 24
Pennsylvania82July 24
West Virginia280July 14
Those nine20,444 
The six reported as being added  
Arkansas205Reported Aug 4
Iowa226Reported Aug 4
Missouri1,095Reported Aug 4
Nebraska91Reported Aug 4
New Hampshire69Reported Aug 4
North Carolina867Reported Aug 4
Those six2,553 
All fifteen22,997Federal count for these states: 1,947

Where each state stands this morning, with the source for every number. Ten rows changed: Alabama, Arkansas, Illinois, Kentucky, Massachusetts, Michigan, New Hampshire, North Carolina, Texas and West Virginia.

State2026 cases reportedRecalled lettuceWhere the number comes from
Alabama85 (Aug 3); 78 lab-confirmed; 2 hosp.; 22 tied to two Mexican-style restaurant chains, which ADPH says are not Taco Bell; 8 travelYesADPH via WAFF
Alaska5 (Jul 16)NoAlaska DOH advisory
Arizona19 (Jul 17)NoAZ DHS, via roundup
Arkansas205 (Aug 5); 108 in Benton County (Aug 3); ADH reports Mondays and FridaysYesArkansas DOH
California41 provisional (Jul 14)NoCDPH NR26-024
Colorado150 (Jul 17); 4 hosp.NoCDPHE, via roundup
Connecticut35YesCT DPH press release
DelawareNo count publishedNoCDC surveillance
Florida254 since May 1 (Jul 25); 264 calendar yearYesFDOH via News4Jax
Georgia11-30 since May 1 (Jul 17)YesGA DPH, via roundup
HawaiiNo count publishedNoCDC surveillance
IdahoNo count publishedNoCDC surveillance
Illinois995 (Aug 4); 58 hosp.; 631 domestic, 193 travelYesIDPH via CBS Chicago
Indiana1,349 (Aug 3); Allen County 290, Marion 108YesIDOH via WRTV / WISH-TV
Iowa226 in 48 counties (Jul 30), calendar year; 47 travel-relatedYesIowa HHS weekly report
Kansas461 (Jul 29); 20 hosp.YesKDHE
Kentucky620 reported (Jul 29), 274 lab-confirmed; 24 hosp.YesKDPH via WSMV
Louisiana1-10 (Jul 17)YesLA DOH, via roundup
MaineNo count publishedNoCDC surveillance
Maryland69 (Jul 17)YesMD DOH, via roundup
Massachusetts145 (Aug 5); 9 in May, 32 in June, 104 in July; small clusters, some apparently linked to the recalled lettuceYesMass. DPH via CBS Boston
Michigan12,218 (Aug 5); up 710 in one day; 193 hosp. (Jul 30); 2 deathsYesMDHHS / Reuters
Minnesota41 since May 1 (Jul 17)NoMDH, via roundup
MississippiNo count publishedYesFDA distribution list
Missouri1,095 (Aug 2); doubled in one week; 90 in Boone CountyYesDHSS via KCTV5 / STLPR
MontanaNo count publishedNoCDC surveillance
Nebraska91 since May (Jul 20); Douglas County alone 45 (Jul 28)NoDHHS via Nebraska Examiner / WOWT
NevadaNo count publishedNoCDC surveillance
New Hampshire69 (Aug 4); 32 tied to recalled lettuce at Cheshire Medical Center, 0 hosp.; 32 unknown source, 3 hosp.; 5 travelYesNH DHHS / NHPR
New Jersey46 (May 1-Jul 11)YesNJDOH news release
New MexicoNo count publishedNoCDC surveillance
New York753 since May 1 (Jul 27 data); 787 calendar yearNoNYSDOH
North Carolina867 since May (Aug 4); up 149 in a week; 33 hosp.; 494 in Wake CountyYesNCDHHS dashboard
North DakotaNo count publishedNoCDC surveillance
Ohio4,013 in 80 counties (Jul 30); 96 hosp. (Jul 17); ODH puts Lucas Co. at 554, the county health dept. at 1,218 (Aug 3)YesODH via WOSU / Toledo Blade
Oklahoma426 (Aug 4); 418 confirmed, 8 probable; 25 hosp.YesOSDH via KOKH
Oregon23 in 2026 (Jul 24)NoOregon Health Authority
Pennsylvania82 (Jul 29); voluntary reporting, no state dashboard; PA DOH last published 28 (Jul 16)YesPA-HAN Advisory #833
Rhode Island4 since May 1 (Jul 17)NoRI DOH, via roundup
South CarolinaNo count publishedYesFDA distribution list
South DakotaNo count publishedNoCDC surveillance
Tennessee11-30 (Jul 17)YesTN DOH, via roundup
Texas198 (Aug 5); 37 hosp.YesDSHS via USA TODAY
Utah1-10 (Jul 17)NoUT DHHS, via roundup
VermontNo count publishedNoCDC surveillance
Virginia126 total (Jul 23); 66 domestic, 31 travel, 29 pendingYesVirginia DH
Washington38 (May 1-Jul 17)NoWashington DOH
West Virginia280 (Aug 4); 20 hosp.YesWV OEPS
Wisconsin160 (Jul 29); 3 hosp.; 50 domestically acquiredYesWisconsin DHS
WyomingNo count publishedNoCDC surveillance
Nine outbreak states20,4449 
Received the recalled lettuce24,04728 
Did not receive it1,16622 
All fifty states25,21350 

One more number, because 25,213 is a floor and not an estimate. In 2011 Elaine Scallan and seven colleagues at CDC published the agency’s foodborne burden model in Emerging Infectious Diseases, and its Table 2 still carries the only published United States burden estimate specific to Cyclospora. The underdiagnosis multiplier for this parasite is 83.1. For every laboratory-confirmed case, CDC’s own model assumes about eighty-three people actually got sick. Applied where it belongs, to the 10,468 laboratory-confirmed cases CDC reports this season, it puts the real number near 869,891. It does not go on 25,213. The state totals already include the cases the multiplier exists to estimate, so multiplying those counts the same people twice.

That is arithmetic rather than a measurement, and it should be read as a ceiling. The model’s own credible interval for Cyclospora runs from 137 to 37,673 domestically acquired foodborne illnesses a year, a 275-fold spread and the least precise line in the table. The 83.1 was built from data gathered before multiplex PCR panels carried a Cyclospora target at all, which happened in 2014, and an outbreak that has doctors ordering the test drives the true multiplier down further. Nobody has published an updated one; the 2025 revision of that paper covers seven pathogens and this parasite is not among them. What the figure is good for is the shape of the problem. The same table puts Listeria at 2.1, because severe illness gets diagnosed and a miserable, self-limiting one does not.