Helena Bottemiller Evich’s Friday edition of Food Fix made an argument I have been making in pieces all summer, and she made it in one clean sweep: Congress has stopped doing its job. When she had me on her American Dish podcast on Sept. 2 to talk about the Cyclospora outbreak, I said much the same thing: the blame for our food safety troubles rests less with any one administration than with Congress’s decades-long unwillingness to stay on top of food safety policy and to pay for it. She called what we are watching “the slow rot of what was supposed to be our most important branch.” I agree. After more than thirty years of watching Congress respond, or fail to respond, to outbreaks, I want to add what that rot looks like from where I sit.

A 12-to-11 farm bill

On Wednesday the Senate Agriculture Committee advanced the farm bill 12 to 11 on a party-line vote, and it took the return of Sen. Mitch McConnell of Kentucky, back after more than three months away following a fall, to get there. Most of the coverage focused on McConnell. Helena focused on the more important point: that his vote was needed at all.

The contrast with 2018 is stark. That year the Senate committee cleared its farm bill 20 to 1, and the full Senate passed it 86 to 11, the most votes a Senate farm bill had ever received. The farm bill is supposed to be rewritten every five years. The 2018 law expired in 2023 and has been kept alive by extensions ever since, and the current extension runs out Sept. 30. Child nutrition programs, which cover school meals, have not had a full reauthorization since the Healthy, Hunger-Free Kids Act of 2010.

The largest outbreak in three decades, and no hearing

This summer’s Cyclospora outbreak is the one I know best. As of Sept. 15, CDC counted 19,883 lab-confirmed, domestically acquired cases with onsets from May 1 through Aug. 31, including 1,064 hospitalizations and two deaths, in 49 states and the District of Columbia. CDC says it is aware of more than 36,000 cases in all. The same months in 2025 produced 1,180. When CDC declared the outbreak over on Sept. 11, it tied 12,883 illnesses to iceberg lettuce from Taylor Farms de Mexico, which leaves exactly 7,000 confirmed cases with no food named.

Members of Congress noticed. Thirteen letters had gone to FDA, CDC, HHS and Taylor Farms by the end of August. Rep. Debbie Dingell and nine House colleagues sent a fourteenth, to USDA, on Sept. 14. On Sept. 17, Rep. Rosa DeLauro, Senate Democratic Leader Chuck Schumer and 23 other members sent a fifteenth, the first from both chambers, asking USDA to stop closing the Beltsville lab where its Cyclospora research is done. Eight of the fifteen set dated deadlines, and all eight passed without a published answer, as I wrote this week. No committee has held a hearing.

There is a structural reason for that, and it is not a partisan complaint. Every one of those letters came from members of the minority party; the newest carries 25 signatures, and none of them belongs to someone who holds a gavel. A member in the minority can write a letter. Only the majority, through its committee chairs, can call a hearing, issue a subpoena and put a witness under oath. When the gavel stays on the table, the letters are all there is, and agencies and companies have learned that letters can go unanswered.

Fifty-two babies, and no oversight hearing

Helena also pointed to the infant formula botulism outbreaks. By CDC’s count, 48 infants in 17 states were hospitalized in the ByHeart outbreak, the largest infant botulism outbreak in American history, and four more in the Nara Organics outbreak. That is 52 babies. I represent families in both. In late August, whole genome sequencing linked the two outbreaks through a shared dairy ingredient. There has not been a single oversight hearing on either one.

Compare 2022. When the Abbott plant in Sturgis, Michigan, shut down and the formula shortage hit, the House Energy and Commerce oversight subcommittee brought formula company executives in to testify in May, and the FDA commissioner went before the Senate HELP Committee the next day. Compare 2009, when the same House oversight panel called Peanut Corporation of America’s Stewart Parnell to testify within weeks of the recall, and he took the Fifth. Compare July 1998, when the Senate Permanent Subcommittee on Investigations held a hearing on Cyclospora in imported raspberries. That was Congress doing its job.

There is a bill. H.R. 7867 would put C. botulinum on the list of organisms formula makers must test for. The House Health Subcommittee held a legislative hearing on it April 29, and it has waited since for a markup nobody has scheduled. I have written Energy and Commerce and Senate HELP twice each, in June and again in August, and none of the four letters has drawn a reply. HELP Chairman Bill Cassidy did demand answers from Nara and ByHeart, and he deserves credit for it, but a letter is not a markup. This week t-shirts are being hand-delivered to all 77 members of those two committees. I have also turned to a citizen petition asking FDA to require the testing by regulation, with 24 parents of hospitalized infants as co-petitioners. When Congress will not act, the agencies are the only door left open.

When Congress does act, it acts quietly

The most consequential thing Congress did on food safety in the past year it did by rider. Section 780 of the continuing resolution that ended last fall’s shutdown, P.L. 119-37, bars FDA from spending money to administer or enforce the food traceability rule before July 20, 2028. That is the rule built to speed tracing of high-risk foods, leafy greens among them. The Senate Appropriations Committee had written the opposite, language telling FDA not to delay enforcement past July 2028. The House version won. There was no hearing on that choice either, and the lobbying behind it became public only because the Guardian went and read the disclosure filings.

The agencies are paying for it, too

Helena’s reading list makes the rest of the case. STAT reports that the FDA is trying to hire more than 2,000 people after losing about 3,500 in the April 2025 cuts, and that the hiring is stuck in the same administrative bottlenecks the cuts created. Civil Eats reports a GAO finding that the government spent about $9.5 billion in 2025 paying employees on administrative leave, most of it through the deferred resignation program, and that USDA cut about 20 percent of its staff and HHS about 18 percent. Whatever anyone thinks of those decisions, this is exactly what oversight hearings exist for: asking whether the agencies that inspect our food have the people to do it.

What would help

I have no interest in stirring the political pot, and Helena was careful to say the decline has held no matter which party is in power. The fixes are not partisan either.

First, hold the hearings. The House Energy and Commerce Committee, the Senate HELP Committee and the agriculture appropriations subcommittees in both chambers have jurisdiction over this summer’s outbreak and the formula outbreaks. Call CDC, FDA and the companies. Ask where the other 7,000 Cyclospora cases came from, why fifteen letters have no published answer, and why powdered infant formula is still not tested for C. botulinum. If witnesses will not come, subpoena them.

Second, do the routine work. Pass a farm bill instead of a fourth extension. Reauthorize child nutrition programs for the first time since 2010. Fund the FDA on time, so the agency is not planning around the next shutdown.

Third, give the next Congress a to-do list it can act on. I have been circulating a food safety agenda, Project 2027, among consumer and public health groups for comment, and a signed version goes to the new Congress in January. It names specific problems and specific fixes.

Helena asked what disaster it would take to get Congress’s attention. More than 36,000 Cyclospora cases, fifteen letters without a published answer and 52 babies hospitalized with botulism should have been enough. If they were not, the problem is not the size of the disaster. It is an institution that has forgotten one of its core jobs, and the rest of us need to remind it.

On September 15, the California Leafy Greens Marketing Agreement (LGMA) posted a white paper marking twenty years since the 2006 spinach outbreak that led to its creation. It is called “Twenty Years of Progress,” and its executive summary ends on a line I agree with: food safety is never finished.

Four days earlier, CDC declared the 2026 Cyclospora outbreak linked to Taylor Farms de Mexico iceberg lettuce over. CDC’s final count was 12,883 illnesses in 21 states, at least 570 hospitalizations and two deaths in Michigan. FDA says it is still investigating how the lettuce was contaminated. The white paper does not mention Cyclospora, this outbreak, Mexico or iceberg lettuce.

I have sued lettuce companies for nearly thirty years. I also think the LGMA is the organization best placed to keep the next one of these outbreaks from happening. This post is about both: what the LGMA has said this summer, what it has not, and work we could do together.

What the LGMA said this summer

The LGMA was not silent in July and August. Its public record, in order:

  • July 15 and 24. LGMA’s first outbreak statement called lettuce a leading suspect and noted that CDC had discontinued routine national reporting of cyclosporiasis in 2025 after budget cuts. By July 24 a different statement sat at the same web address: sympathy for those sickened, credit to health officials, and acceptance of Mexican-grown lettuce as the likely source. I wrote about the swap in July, and said then that the deleted paragraph was the truest thing any trade group had said about the outbreak.
  • July 20. The California and Arizona LGMAs held a public webinar with food safety scientist Dr. Jennifer McEntire on what is known and unknown about Cyclospora, including why testing produce and water for the parasite is so hard. California LGMA CEO Tim York said the goal was to cut through confusion and misinformation.
  • July 27. York told CBS News that LGMA membership is voluntary, but “once they join, they must follow our rules.”
  • August 9. California LGMA said California lettuce and leafy greens were in full production and not associated with the outbreak, and published a fact sheet on why its members’ greens are low risk for Cyclospora. Arizona LGMA posted its own.
  • August 20. LGMA reported hosting five FDA produce safety staff on an August 12 farm tour in the Salinas Valley.

The webinar and the FDA tour were good work. The paragraph that got deleted was good work too.

What the LGMA has not said

Since August 9, I cannot find anything either LGMA has said publicly about the outbreak, on its website or in the press. There was no statement when CDC closed the outbreak, and none on FDA’s continuing investigation. There has been nothing on the roughly 7,000 laboratory-confirmed, U.S.-acquired cases this season that are not tied to any food. CDC’s case page now counts 19,883 confirmed domestic cases from May 1 through August 31, against the outbreak’s 12,883. The two counts carry as-of dates four days apart.

The white paper names two outbreaks, spinach in 2006 and Yuma romaine in 2018. It never names a pathogen, not even E. coli O157:H7 in 2006. The 2019 and 2020 romaine E. coli outbreaks appear only as timeline entries about “new risks” and “food safety updates.” Yet one of the twenty changes the paper lists is root cause investigation after food safety events.

Why the LGMA is in a unique position to lead

Taylor Farms is an LGMA member. It is on the California LGMA’s 2025 certified member list, it holds a seat and an alternate seat on the Advisory Board, and its people sit on the Communications and Technical Committees. The lettuce that sickened 12,883 people came from Taylor Farms de Mexico, outside the program the LGMA audits. A family buying a bag of shredded iceberg sees a brand, not a farm. For them there is no line between a member’s California lettuce and the same member’s Mexican lettuce. The company’s outbreak and recall history is its own story; the point here is that the grower at the center of this outbreak helps govern the program.

That is the problem, and it is also the opportunity. The LGMA has things no regulator or advocacy group has:

  • Reach. The white paper says LGMA members grow 94 percent of U.S. leafy greens.
  • Speed. Membership is voluntary, compliance is not, and audits are done by the California Department of Food and Agriculture under USDA oversight. The white paper counts more than twenty updates to LGMA standards in twenty years. Federal rules take years each.
  • Data. Through Romaine Test & Learn, members already pool pathogen-testing results.
  • A shared stake. California farmers told Ag Alert in August that the loss of consumer confidence was the worst since the 2006 spinach outbreak. Growers who did nothing wrong paid for this one.

The white paper’s own 2026 strategic plan names public trust building, through accountability and transparency, as one of three priorities. This is the moment for it.

Ten things we can work on together

  1. Close out the outbreak in public. Acknowledge the final count, the people sickened and the two who died and commit to report what members learn from it.
  2. One standard for the label, wherever the lettuce is grown. Members’ leafy greens from outside California and Arizona should meet LGMA-equivalent standards, verified by audits comparable to CDFA’s. Where they do not, buyers should be told which product is outside the program.
  3. Write Cyclospora into the metrics. Cyclospora comes from human feces, so the controls are field sanitation and handwashing, keeping sick workers out of harvest, and protecting water sources. Workers need paid sick leave for staying home to be possible. LGMA’s own webinar stressed that testing is not the answer, which means prevention has to carry the load, and better detection methods deserve research money through the Center for Produce Safety.
  4. Publish the root cause. When FDA finishes its investigation, the LGMA should say publicly what it will change. The public should see root cause findings, not just be told they happen.
  5. Name the grower when the file closes. In November 2024, a romaine E. coli O157:H7 outbreak sickened 89 people in 15 states, hospitalized more than a third and killed one. FDA closed it in February 2025 without naming a grower or processor. On September 10, FDA closed a fourteen-person romaine outbreak, reference #1382, the same way, saying the lettuce was past its shelf life. FDA has named farms, processors and brands in that exact situation before. The LGMA should ask FDA to name growers and processors when traceback reaches them, and members whose product was in a traceback should say so themselves.
  6. Share the data with public health. Expand Romaine Test & Learn to other crops and to water and environmental results, and give FDA and CDC access as results come in.
  7. Bring back the Microbiological Data Program. From 2001 to 2012, USDA’s Microbiological Data Program worked with state agriculture departments to test fresh produce for pathogens. At about $4.5 million a year it was more than 80 percent of government produce testing when its funding ended. The produce industry lobbied to eliminate it. FDA’s Donna Garren has now called for a national approach to produce microbiological data like it. This is surveillance, not testing as prevention, and it tells FDA, CDC and growers where the risk is. LGMA support for its return would carry weight in Congress.
  8. Meet federal traceability rules now. The compliance date for FDA’s food traceability rule under FSMA Section 204 has slipped to July 2028. The white paper says members already keep extensive electronic records. They can meet the rule ahead of the deadline.
  9. Open the neighbor’s gate for E. coliLeafy greens E. coli investigations keep pointing to nearby cattle, and investigators often cannot get onto adjacent animal operations to sample. I have drafted a citizen petition asking FDA to use its existing public health authority to get that access during outbreak investigations. The LGMA’s support would matter.
  10. Stand up for public health capacity. This industry needs outbreaks found fast and sources named fast. Say so to Congress when CDC, FDA and state laboratory budgets are on the table, and support affordable Cyclospora testing so sick people get counted.

An invitation

I have been on the other side of the table from LGMA members for a long time, and I expect to be again. I would rather not be. The LGMA was built after a tragedy by growers who decided the whole industry had to change because one company’s problem was everyone’s problem. A leafy greens executive says exactly that in the white paper. This summer taught the same lesson again, at more than sixty times the size of the 2006 outbreak.

The LGMA says food safety is never finished. I agree. Let’s finish the next piece of it together, and I would welcome the conversation.

De Ann Davis, senior vice president of science at the Western Growers Association, published a piece on August 31 arguing that FDA outbreak communication is itself a food safety tool and needs to work better. I missed it when it came out. It deserves a reply, because I agree with most of it, and the places where I do not are where the next outbreak will be won or lost.

One thing first. Davis told the Guardian in August that growers have collected shipment data voluntarily for more than a decade and that Western Growers supports the Food Traceability Rule. That put growers on the record on the other side from the retail and foodservice associations that lobbied for delay. Nothing below changes my respect for that.

Where we agree, and it is most of it

Her framework is close to what I have asked for all summer. Every advisory should say what is confirmed, what is reasonably suspected, what is unknown and what would change the agency’s view. As soon as the evidence permits, the FDA should name the commodity, product form, brand or supplier, country and growing region, distribution channel and dates, and when those details are unknown, say so. Corrections should be time-stamped and pushed through the same channels as the original. After the hazard passes, the agency should publish root-cause reports that tell growers, importers and retailers what to change.

She is right that the July 17 naming of Taylor Farms de Mexico was the moment the response started working. It gave restaurants and shoppers a target, and it told everyone else what was not in play. The FDA’s outbreak page still carries that history. She is also right that the FDA should be the hub that separates confirmed outbreaks from concurrent clusters and background surveillance. North Carolina said on July 17 that its increase did not appear connected to the Taco Bell outbreak. That was careful work by a state health department, and no federal page set it beside the national count and explained how the pieces fit.

Where I part company, gently

The first is Michigan. Davis faults the July 4 Michigan advisory for listing produce from past Cyclospora outbreaks, including salad mixes, cilantro, basil, raspberries, snow peas and green onions, when no source had been identified. She calls that a missed opportunity for the FDA, and on that point I agree. The fix is a federal voice, not a quieter state. A health department watching its case count climb with no named food owes the public something, and the history of the parasite was the evidence it had.

The second is what the FDA can honestly say is not implicated. Davis wanted the agency to say this summer that domestic leafy greens had not been implicated, and her September 15 follow-up goes further, arguing that the risk from domestically grown produce is meaningfully lower than from imports. On the history she has a point, and the FDA’s own Cyclospora action plan says most domestically acquired outbreaks have been tied to imported produce. Now look at this year’s arithmetic. The CDC’s case data page, updated September 15, counts 19,883 confirmed domestically acquired cases from May 1 through August 31. The federal outbreak linked to Taylor Farms de Mexico closed at 12,883. That leaves 7,000 confirmed cases with no food named by any agency.

Davis poses three good questions in that follow-up: where the illness was acquired, where the product was grown and where the contamination occurred. For those 7,000 people the second and third answers are blank, because no agency has said what they ate. An advisory that clears a category before the evidence does is its own kind of imprecision, and it is the kind that gets people sick.

The third is her proposed verification hold. Davis wants preliminary laboratory results with public and commercial consequences verified before release whenever consumer protection does not require immediate disclosure. After the FDA announced a positive lettuce sample on July 18 and called it a false positive on July 19, I understand why. The same correction said the epidemiological and traceback evidence still supported the recall. People were protected by the epidemiology, not by the sample. A verification step is reasonable if it has a clock measured in days and the agency says publicly that a result is pending. Without a clock, verify first becomes announce later.

The cost of imprecision is real

I hold an economics degree, and I do not wave these numbers away. Western Growers estimated $125 million in short-term wholesale losses to California strawberry growers after the 2022 hepatitis A outbreak tied to imported berries. An International Food Information Council survey in mid-August found that among adults who had heard about this summer’s outbreak, 30 percent said they had stopped eating lettuce entirely in the previous month. Fewer vegetables on American plates is a public health cost, and Davis is right to say so. Precision is the answer to it. Precision, though, means naming, and naming sometimes means naming somebody you would rather not.

What precision requires

Two things, and Western Growers is in a position to help with both.

The first is traceability. Supplier, growing region and dates, the second item in Davis’s framework, come from records. Section 780 of last November’s continuing resolution barred the FDA from spending money to administer or enforce the traceability rule before July 20, 2028. I made this argument in July when Joelle Mosso of Western Growers wrote about the Cyclospora response, and it has only gotten stronger since. Western Growers already supports the rule. If it said out loud that Section 780 should be unwound, that would carry weight with Congress that my saying it never will.

The second is naming. On September 10 the FDA closed CORE investigation #1382, an E. coli O157:H7 outbreak with 14 sick, naming romaine lettuce as the source and no grower or processor. The FDA’s investigations table is where that closure lives, in a single line. The 89-person romaine outbreak from late 2024 closed the same way. Under Davis’s framework, if traceback reached one grower, the advisory names the grower. I would like to know whether Western Growers will say so when the grower is a member. That is the hardest version of the question, and it decides whether consumers learn which lettuce or only that it was lettuce.

Davis closed her September piece by asking industry, academia and public health to work together on fact-based context before the next Cyclospora season. I am in. Traceability draws a line. It says what everything else is. Without the line, fear prices the whole category, and the whole category pays.

I have spent more than 30 years representing people sickened by contaminated food. I do not often read a speech by an FDA official and find myself agreeing with nearly every line. This week I did.

Dr. Donna Garren, director of the Food and Drug Administration’s Office of Produce Safety, spoke on Sept. 15 at the annual meeting of the National Association of State Departments of Agriculture in Portland, Maine. I could find only two outlets that covered it, Agri-Pulse and Lancaster Farming, and both are worth reading in full. Her message, in short: the 2026 Cyclospora outbreak exposed weaknesses in how we oversee fresh produce, and FDA needs a system that finds hazards before people get sick rather than after.

She has been on the job less than three months. She joined FDA effective June 29, after nearly 15 years at the American Frozen Food Institute and earlier leadership roles at Boskovich Farms, the United Fresh Fruit and Vegetable Association, the National Restaurant Association, the Consumer Goods Forum and NSF International. Her office writes FDA’s regulations, policy and guidance for fresh fruits and vegetables, including the minimum standards under the FSMA Produce Safety Rule. That background matters. When someone who has spent a career working alongside industry says the system has to change, growers and processors will hear it in a way they may not hear it from me.

Never let a good crisis go to waste

The numbers are hard to overstate. According to FDA, CDC reported 19,595 laboratory-confirmed cases of cyclosporiasis in the United States as of Sept. 8, including more than 12,000 from one multistate outbreak linked to iceberg lettuce from Taylor Farms de Mexico. CDC declared that outbreak over on Sept. 11. Two people died.

Garren told the state agriculture officials that the outbreak should be a moment of reckoning for FDA, because it showed a food safety system that does not always reflect the complexity of today’s global supply chain. Then, according to Lancaster Farming, she reached for the old saying: never let a good crisis go to waste. She is exactly right, and that saying is the history of food safety in this country.

Crises are how this system changes. After the 1993 Jack in the Box E. coli outbreak, USDA declared E. coliO157:H7 an adulterant in ground beef in 1994. Hamburger cases were the core of my practice for a decade, and today they are close to zero for my firm. That is the best thing to happen in food safety in my lifetime, and it came out of a crisis. After the 2006 spinach outbreak and the 2008 to 2009 peanut outbreak, Congress passed the Food Safety Modernization Act, signed in January 2011.

Crises also get wasted. Less than two years after FSMA was signed, USDA shut down its produce testing program. Fifteen years after FSMA, the food traceability rule Congress required, the tool that would let investigators trace lettuce faster, has been delayed again after pushback from industry. Attention fades when the case counts stop climbing. Garren is telling her own agency not to let that happen this time.

If we don’t act, shame on us

The sharpest line of the day did not come from Garren. It came from California Secretary of Food and Agriculture Karen Ross, who chairs NASDA’s Food Systems and Nutrition Committee, the committee Garren addressed. Speaking about how communication breaks down in every outbreak, Ross said: “If we don’t act on this, shame on us.”

She is right, and the “us” is broad. It includes FDA and USDA, the growers, processors and retailers, the Congress that writes the budget, the state agriculture departments in that room, and people like me who have been making these arguments for more than thirty years. More than 19,000 people were sickened in one season, more than 12,000 of them in a single outbreak, and two people died. If a year from now all we have is another round of statements, with no testing program, no rule on naming firms and no published root cause, then shame on all of us.

She wants produce testing back

This is the part of her speech I most want to highlight. Lancaster Farming reports that she wants FDA to reinstate a national approach to microbiological data on produce, similar to USDA’s Microbiological Data Program.

I know that program well. USDA ran it from 2001 to 2012, working with state agriculture departments to sample and test fresh fruits and vegetables for foodborne pathogens, and it ended in December 2012 when its funding was eliminated. In its final year it was a $4.5 million program that accounted for more than 80 percent of government produce testing. The Associated Press reported in 2012 that it had found more than two dozen contaminated samples that led to recalls of lettuce, tomatoes and other foods. I argued at the time that ending it was a mistake, and I have said so many times since. Hearing a senior FDA official say publicly that something like it should come back is welcome news.

She wants the data used before people get sick

Garren described a system that brings together surveillance data, inspection records, outbreak histories and even satellite imaging to flag hazards before illnesses occur. That is the right goal. FDA already holds much of this information. All summer I have been tracking FDA’s own outbreak investigations table, where many files list no food, no on-site inspection, or both. The information exists. What has been missing is putting it to work, and putting it in front of the public. A director who wants to do both has my support.

Same rules for everyone

She said domestic growers, foreign farms and importers must be held to the same standard, and that fairness and public health point in the same direction. That principle matters. The Associated Press found that FDA inspections of foreign food sites are down nearly 35 percent since 2019. When I went through FDA’s investigations table in August, eleven of seventeen open investigations showed no on-site inspection, and the six that did all involved firms on American soil. Parity is fair to American farmers and safer for American consumers.

Name them

Here is the line from her speech I would put on the wall. Garren called transparency both a value and a mechanism, and she said: “When bad actors know they will be named … behavior changes.” She added that this means publishing outcomes, sharing data, and showing that oversight is real and applied without exception.

I have been making that argument in outbreak after outbreak. Earlier this month FDA closed a summer E. coliO157:H7 file by saying romaine lettuce caused it, naming no grower and no processor. Stop Foodborne Illness has a citizen petition pending at FDA, Docket FDA-2026-P-1448, on naming the firms tied to outbreaks. Garren’s principle, applied, answers the question that petition asks.

States as partners

She also wants FDA to work more closely with state agriculture departments and to share information better, describing state staff as the boots on the ground who talk to producers every day. The old Microbiological Data Program ran through state agriculture departments, so a closer federal-state partnership is exactly how a revived testing program would work.

How to make it stick

A speech is a start. Three steps would turn what she said into policy: funding for a national produce testing program in the next federal budget, a rule requiring FDA to name the firms linked to outbreaks, and publication of the root cause findings in the iceberg lettuce outbreak, which FDA says it is committed to sharing. Each of those follows directly from her own words, and together they are what not wasting this crisis looks like. If she wants allies in getting them done, she has one here.

Garren told Lancaster Farming that friends say she picked the worst time to join FDA. She disagrees, and said she likes figuring out what happened and building plans that keep it from happening again. After this summer, that is exactly the attitude the job needs. Welcome, Dr. Garren. Keep saying it.

Woods Hill Table, the farm-to-table restaurant on Commonwealth Avenue in West Concord, Massachusetts, closed on September 16, 2026 while town and state health officials investigate a cluster of Salmonella infections. As of September 17, ten people had been reported ill, both customers and restaurant employees, according to Concord Public Health Director Melanie Dineen. She said she had not heard of anyone being hospitalized. The restaurant has not said when it will reopen.

Nearly everything the public knows comes from one place: reporting by Dakota Antelman of The Concord Bridge, which obtained Dineen’s September 15 memo to the Board of Health and interviewed her. The Bridge’s first version of the story said the memo did not name the illness; the updated version, after Dineen spoke with the paper, identifies it as Salmonella. As of this writing, neither the Town of Concord nor the Massachusetts Department of Public Health has posted anything about the cluster.

What the Concord investigation has found so far

According to Dineen, the investigation began on September 8. An initial inspection of the restaurant found no priority violations, and in those early days she did not believe there was a risk to the public. Testing then turned up more cases, including one person who was carrying Salmonella without symptoms. About a week into the investigation, Dineen advised Woods Hill Table to close, and the restaurant agreed.

Her memo says state epidemiologists individually contacted every affected patron and that there is currently no ongoing risk to the general public. It also says management and staff gave officials full access for environmental sampling and employee retraining. Each staff member must have two negative test results before returning to work. Local officials believe this is most likely an isolated incident, but Dineen wrote that more testing is needed to confirm it.

Owner Kristin Canty told the Bridge in an emailed statement that the restaurant takes food safety protocols very seriously and is cooperating with state authorities. Dineen praised the management’s response, saying they are doing everything they are supposed to.

What Concord got right

When employees are among the sick, closing the kitchen and testing everyone who works in it is the right call, and requiring two negative results before anyone returns is how you keep a cluster from restarting a week after the doors reopen. The asymptomatic carrier found here is the reason that rule exists: a food handler who feels fine can still shed the bacteria. As Dineen noted, Salmonella spreads through food and from person to person.

It also matters that the restaurant cooperated, and that the health director said so publicly. In more than thirty years of foodborne illness cases, I have seen the damage done when a business fights the health department instead of working with it. That did not happen here.

What the public still does not know

1. Which serotype? Salmonella has more than two thousand serotypes. Knowing whether this is Enteritidis, Typhimurium or something rarer says a lot about where to look.

2. What dates? Neither the memo nor the Bridge story gives the dates of illness or the meal dates involved. A diner who ate there in early September and was sick but never tested has no way of knowing whether they belong in this count.

3. Who got sick first? If employees fell ill before customers, the likely explanation is an infected worker. If customers and employees fell ill together, a contaminated ingredient served to both becomes the stronger possibility. The order matters.

4. Has the state lab sequenced the isolates? Whole genome sequencing will show whether the ten cases share one strain and whether that strain matches illnesses anywhere else in the country.

5. What did the environmental sampling and food testing find? The memo says sampling was done. The results have not been released.

6. How were the patrons identified? Contacting every affected patron is good work. The public should know whether that list came from reservations and card records, and whether anyone who walked in or paid cash could have been missed.

Why “isolated” has to be proven, not assumed

A restaurant is often the last stop in a supply chain, not the first. The same contaminated ingredient that sickens diners in one dining room can sicken people in other states who have no idea they shared a supplier. The only way to rule that out is laboratory data.

Massachusetts has that data. Salmonella infections are reportable to the state Department of Public Health, and clinical labs must send isolates to the State Public Health Laboratory. A CDC Emerging Infectious Diseases study of Massachusetts surveillance reported that the state averaged about 1,200 confirmed Salmonella cases a year from 2014 through 2018, and that the state lab has reported cluster patterns to CDC’s PulseNet network since 1996, now increasingly by whole genome sequencing. DPH also posts year-to-date foodborne illness counts, currently through September 1, which is too early to show this cluster.

Dineen and the Concord Board of Health have handled this responsibly. The next step is for DPH to say publicly what the sequencing shows. If the Woods Hill Table strain matches nothing else, officials can say so with confidence. If it matches cases elsewhere, the public needs to know which ingredient and which supplier, because the risk will not have ended at a closed door in West Concord. CDC estimates that Salmonella causes about 1.35 million infections, 26,500 hospitalizations and 420 deaths in the United States every year.

If you ate at Woods Hill Table and got sick

Symptoms of salmonellosis include stomach cramps, diarrhea, fever, nausea and vomiting, and some cases are severe enough to require hospitalization. If you ate at the restaurant in September and have been ill, see a health care provider, ask for a stool test, and tell them where you ate. A positive test is what puts your case into the investigation. You can also contact the Concord Public Health Division. Anyone with symptoms should not prepare food for others until they have recovered.

Dineen’s September 15 memo went to the Board of Health, and should become public through the Board’s meeting records or the Great Meadows Public Health Collaborative, where Concord posts agendas and minutes.

Three questions about the Woods Hill Table Salmonella cluster

Why did Woods Hill Table close? Concord’s public health director advised the West Concord restaurant to close about a week into a Salmonella investigation that began September 8, after testing found additional cases. The restaurant agreed and closed September 16.

How many people are sick? Ten as of September 17, including both customers and employees, with no reported hospitalizations.

Is there a risk to the public? Town officials say there is currently no ongoing risk, and state epidemiologists have contacted each affected patron. They describe the cluster as most likely isolated but say more testing is needed to confirm it.

I will update this post when Concord or the Massachusetts Department of Public Health releases the serotype, the dates of illness, or the sequencing results.

The multistate Cyclospora outbreak linked to iceberg lettuce from Taylor Farms de Mexico closed on September 11, 2026 with 12,883 illnesses, 570 hospitalizations and 2 deaths in 21 states. Investigators did not lose the supply chain. They followed it to the supplier within a day and lost it at the last link, the farm field and whatever water touched the lettuce there. That last link is what the federal Food Traceability Rule is built to record, and Congress has told the FDA it may not spend money enforcing that rule until July 20, 2028.

The Packer ran a thoughtful piece Thursday by Jill Dutton with Fabiola Negrón, director of food safety at Registrar Corp. Her diagnosis is sound. People remember meals poorly and weeks after the fact. Records run out a few steps back. A company can keep good internal records that never connect to its growers’ records. Produce with a short shelf life is gone before anyone can test it. On Cyclospora specifically, she said finding the product was the simpler part, and that once investigators knew the supplier, the gap was that the supplier did not know the source.

She is right. The headline, though, says the outbreak ended in a supply chain mystery, and the distinction matters for what gets fixed.

What investigators found, and how fast

The FDA and CDC announced the investigation on July 16. On July 17 the agencies said traceback had converged on a single supplier, Taylor Farms de Mexico, and the company recalled all iceberg lettuce sourced from central Mexico. On July 19 the FDA withdrew a positive lettuce sample as a false positive, and no product sample has since tested positive. The link rests on epidemiology and traceback. In August, CDC added genotyping showing that the parasites from sick people were genetically related, which ties patients to each other and to a single source, though not to a sample of lettuce.

For fairness: Taylor Farms says it raised scientific questions about the government’s assumptions and methodology in its first call with the FDA, CDC and Michigan health officials. Neither agency has changed its conclusion. CDC’s outbreak page still states that the investigation linked the outbreak to processed iceberg lettuce from Taylor Farms de Mexico.

Where the trail went cold

On August 20 the FDA’s inspection moved from the processing plant to iceberg lettuce growers in Mexico. At the close, Food Safety Magazine reported that the FDA had completed inspections and sampling at the growers and the processing facility, with results pending and root cause work continuing. The FDA’s own post-outbreak page says its investigation of the Taylor Farms de Mexico outbreak goes on, along with the investigations into the other clusters this summer.

Consider also the size of the recall: all iceberg lettuce from a region of Mexico. That is my reading, not an agency finding, and a company acting out of caution would recall the same way. Still, a recall drawn around a region instead of a lot or a field is what the gap Negrón describes looks like in practice.

The rule that records the field

Section 204 of the Food Safety Modernization Act, signed in January 2011, told the FDA to propose traceability requirements for high-risk foods by January 2013. The agency missed the deadline and wrote the rule only after the Center for Food Safety sued and a court set a schedule. The final rule came out in November 2022. For foods on the Food Traceability List, which includes leafy greens, it requires key records at each step, including a traceability lot code and where the food was harvested, and it requires companies to produce those records for the FDA in a sortable electronic spreadsheet within 24 hours.

The compliance date was January 20, 2026, nearly five months before the first illness in this outbreak. In March 2025 the FDA announced a 30-month delay. In November 2025 Congress went further. Section 780 of Division B of H.R. 5371, the bill that ended the shutdown, bars the FDA from using appropriated funds to administer or enforce the rule before July 20, 2028, according to a Congressional Research Service report. A delay is an agency deciding industry needs more time. A funding prohibition leaves the agency unable to act even if it changes its mind. The Packer notes the 2028 date without explaining where it came from. Fifteen and a half years separate the statutory deadline from the first day of enforcement.

Nobody can prove after the fact that an enforced rule would have taken investigators to one field this summer. Getting investigators to the field is what the rule is designed to do, and this outbreak is the case it was written for.

The fear she describes is a cost to industry

Negrón made a point the produce industry should take to heart. Frightened shoppers do not read lot numbers. They avoid the whole category until the news fades. The Packer’s own reporting found that this outbreak hurt grocery foot traffic well beyond the produce aisle. Traceability draws a line around the problem, and without that line fear prices the entire category. Growers, packers and retailers who did nothing wrong paid for that this summer.

Some of the associations speaking for those same retailers and distributors asked Congress to wait on the rule, as their own lobbying disclosures show. I wrote about those filings in August. Western Growers told the Guardian that it supports the rule, so industry is not of one mind, and that is worth remembering.

The bigger mystery

The mystery The Packer’s headline promises is real, but it sits elsewhere. CDC now counts 19,883 laboratory-confirmed, domestically acquired _Cyclospora_ cases from May 1 through August 31. Subtract the 12,883 in the lettuce outbreak and 7,000 confirmed cases remain with no food named. Those investigations never got far enough to hit a supply chain wall. On September 15 CDC stopped updating that page weekly. Over the coming months, epidemiologists and I will be working to learn where those people were infected.

Questions readers are asking

Did investigators find the source of the 2026 Cyclospora outbreak?

They found the supplier, Taylor Farms de Mexico, within a day of announcing the investigation. As of the September 11 close, the FDA had not named a farm or a root cause, and sample results from the Mexican growers were pending.

Would the Food Traceability Rule have helped?

The rule requires harvest location and lot codes to travel with leafy greens and requires records within 24 hours. Enforcement is barred until July 20, 2028.

Test the system

Negrón’s advice to companies is to test the traceability system rather than keep a plan on paper. Congress should take the same advice. The country had a system, with a written rule and a compliance date, and Congress took the money away before anyone could test it. Eleven consumer, public health and labor organizations have asked Congress not to push the rule back further. The fastest way to shrink the next supply chain mystery is to let the FDA enforce the rule it already wrote.

On September 17, Representative Rosa DeLauro and twenty-four other Democrats in the House and Senate wrote to Agriculture Secretary Brooke Rollins asking USDA to stop closing the Beltsville Agricultural Research Center and to put its Cyclospora research back to work. It is the fifteenth congressional letter on the 2026 outbreak, the second to USDA in four days, and the first signed by members of both chambers. DeLauro’s announcement names seven lawmakers; the letter itself carries twenty-five signatures, seventeen from the House and eight from the Senate, including Senate Democratic Leader Chuck Schumer. That makes six House letters, eight Senate letters and one from both, all from Democrats. I last wrote about the letters on September 15. As of this afternoon I still cannot find a published answer to any of them.

The letter says the outbreak has sickened nearly 20,000 people. CDC’s case data put it at 19,883 laboratory-confirmed domestic cases for the May 1 to August 31 season, with 1,064 hospitalizations and two deaths in forty-nine states and the District of Columbia, as of September 15. CDC says that was its last weekly update; the page will now change only periodically. On September 11 CDC declared the outbreak over with 12,883 illnesses tied to iceberg lettuce from Taylor Farms de Mexico. That leaves exactly 7,000 confirmed cases this season with no food named. FDA says its investigation continues. Where those 7,000 people picked up the parasite is a research question, and research is what this letter is about.

What the fifteenth letter adds

The fourteenth letter, from Representative Debbie Dingell and nine House colleagues, asked whether USDA would seek the congressional approval its reorganization requires. The fifteenth goes after the Department’s explanation. USDA told Politico, in a statement Reuters carried, that Congress did not fund two of the three Beltsville Cyclospora projects for fiscal 2026 and that none of the research has been disrupted. The members write that Congress ended that funding on technical advice from USDA that the researchers would stay at Beltsville and that the Department would keep their expertise without ending its Cyclospora work. That is the members’ account. USDA has not published one.

On the third project, which is still funded, the letter relies on Politico’s reporting that the scientists declined orders to move to Iowa, leaving no dedicated USDA staff to study the parasite. It asks five questions: whether all the Beltsville Cyclospora staff have declined to relocate and whether anyone has been hired to replace them; how many other projects will lose scientists; how USDA will keep the research uninterrupted; where the work will go and whether the receiving labs can handle it; and whether USDA will ship highly pathogenic organisms across the country, and how safely.

The members write that USDA has spent more than $170 million upgrading and repairing Beltsville since 2016, including a $32 million renovation of its food safety laboratory finished in 2022, and that the Agricultural Research Service receives more than $1.8 billion a year. They ask USDA to stop the closure and halt the reorganization. Unlike the Dingell letter, which asked for answers within two weeks, this one sets no date. It asks for a timely response.

Why it matters

For two months I have written that the letters asked about surveillance cuts, political influence and the recall, and that none of the first thirteen asked how to keep the next outbreak from happening. Two letters in four days now do. There is no whole genome sequencing for this parasite. CDC links cases by genotyping, and used it in this outbreak to show the parasites making people sick were genetically related. That science does not maintain itself.

In July, Secretary Rollins told a Hill audience that cyclosporiasis is an FDA issue, not a USDA one. On outbreak response that is mostly right. On research it is not, and two letters have now gone to the department that holds the bench.

Here is the whole list, updated. The column on the right is still the one to read.

DateWho wrote, and to whomWhat was asked forDeadline and status
Jul 14Sen. Amy Klobuchar (MN) to CDC and FDARestore FoodNet, FERN, inspection staffing and public health grantsNone set. No answer found
Jul 15Rep. Greg Stanton (AZ) to Sec. KennedySix questions: who ordered the surveillance change, what funding was cut, how many staff lostAug 3. Passed, no answer found
Jul 16Sen. Jon Ossoff (GA) to Sec. KennedyThree questions on restoring Cyclosporatracking and the state of the investigation72 hours, Jul 19. Passed, no answer found
Jul 17Reps. Dingell, McDonald Rivet, Scholten and Tlaib (MI) to CDC and FDATen questions from inside the outbreak, including whether the agencies agree with Michigan on the sourceJul 24. Passed, no answer found
Jul 20Rep. Josh Gottheimer (NJ) to CDCRestore FoodNet to mandatory active surveillance, plus two billsNone set. No answer found
Jul 20Sens. Blumenthal (CT) and Booker (NJ) to CDCA briefing on how the outbreak was tracked and whether staffing cuts caused delayUndated. No answer found
Jul 24Sen. Ossoff, second letter, to Sec. KennedyThe same three questions, plus the fact that the first letter went unansweredNone set. No answer found
Jul 27Rep. Robert Garcia (CA), Oversight Ranking Member, to Bruce TaylorFive categories of documents and five written questions, including facility records back to 2013Aug 10. Passed, no production found
Jul 28Sen. Kirsten Gillibrand (NY) to CDC and FDASix questions on the collapse of the federal laboratory networkJul 31. Passed, no answer found
Jul 30Sen. Blumenthal, PSI Ranking Member, to FDAAll records, including every communication with the White House and with the companyAug 13. Passed, no answer found
Jul 30Sen. Blumenthal, PSI Ranking Member, to Bruce TaylorAll records, including every communication with the White House and with FDAAug 13. Passed, no production found
Jul 30Reps. Veasey, Dingell and Sewell with about fifty colleagues, to CDC and FDATransparency and immediate action to identify the sourceNone set. No answer found
Aug 13Sen. Elizabeth Warren (MA) to Sec. KennedyNine questions on the retracted test, the White House call, what the outbreak has cost, and which states still reportAug 27. Passed, no answer found
Sep 14Rep. Dingell (MI) and nine House colleagues to Sec. Rollins, USDASix questions on the shelved Cyclosporaresearch, staff losses at the research service, and whether USDA will seek congressional approval for its reorganizationTwo weeks from receipt, about Sep 28. Pending
Sep 17Rep. Rosa DeLauro (CT), Sen. Chuck Schumer (NY) and 23 other Democrats in both chambers to Sec. Rollins, USDAFive questions on the Beltsville Cyclospora staff, the relocation plan and moving pathogens; stop closing Beltsville and halt the reorganizationNone set. Sent Sep 17

I believe that is every letter and I am not certain it is. I have had to add letters after publishing before. No answer found means exactly that and nothing more; an agency can answer a member privately, and neither side has to publish it. If you have an answer to any of these, send it and I will correct this post.

The fix is in the next funding bill

USDA blames the fiscal 2026 appropriations law; the members say Congress acted on USDA’s own advice. Either way, the repair runs through one place. The November 2025 law that ended the shutdown carries both the Beltsville funding decision and Section 780, which bars FDA from spending money to administer or enforce the food traceability rule before July 20, 2028. Fiscal 2027 begins October 1, and the letter says Democrats are ready to build on existing Cyclospora research in the final funding agreement. Congress can restore the research and lift the traceability delay in that bill. Neither fix needs a letter. The Beltsville reversal does not even need Congress; the members write that it is wholly within the Secretary’s power to do immediately.

Still no hearing

Eight dated deadlines have passed without a published answer, the last on August 27. The Dingell letter’s two weeks run out around September 28, and the DeLauro letter set none. No committee has noticed a hearing. The Senate Permanent Subcommittee on Investigations, which held a hearing on Cyclospora in imported raspberries in July 1998, can issue a subpoena; Senator Blumenthal wrote as its ranking member, and a ranking member cannot subpoena alone. The House Oversight majority can adopt Representative Garcia’s document request as the committee’s own. The Agriculture Committees oversee USDA, and the appropriators fund all three agencies. Twenty-five members signed the newest letter, and none of them holds a gavel. Every one of those tools belongs to the majority.

CDC has stopped counting weekly. Fifteen letters have put them in writing, and not one has a published answer. If a letter will not put anyone in a chair, a subpoena to a hearing will.

Someone asked me today what is going on with Cyclospora. Here is where things are as of a few moments ago.

CDC updated its Cyclospora case-data page on September 15, 2026, and said it was the last weekly one. It now reports 19,883 laboratory-confirmed cases of cyclosporiasis acquired in this country since May 1, 1,064 hospitalizations, two deaths and cases in forty-nine states plus the District of Columbia, against 1,180 for the whole of last season. The federal outbreak linked to Taylor Farms de Mexico iceberg lettuce closed on September 11 at 12,883 illnesses, 570 hospitalizations, two deaths and twenty-one states, with a last illness onset of August 17. The fifty state health departments now report 33,556 cases this season.

Cyclosporiasis is an intestinal illness caused by Cyclospora cayetanensis, a microscopic parasite spread through human feces in contaminated food or water. Washing does not reliably remove it, and chlorine does not kill it.

The unattributed pile is now exactly 7,000, and it shrank for a reason that is not an answer.

19,883 confirmed nationally, 12,883 in the outbreak, 7,000 left over. A week ago that number was 8,137. It fell by 1,137, and not one of those 1,137 people was tied to a food anyone has named. CDC’s final outbreak update added 1,425 people to the Taylor Farms count and a twenty-first state, Virginia, on the day it closed the file. The national series grew by 288 in the same stretch. The pile got smaller because CDC finished assigning interviews it already had, not because an investigation found anything.

Roughly two in three confirmed illnesses now carry a federal attribution of any kind, up from three in five a week ago. Measured against everything CDC says it is aware of this season, 36,242 cases, it is about one in three. Measured against the 33,556 the states themselves report, it is closer to two in five.

FDA’s inspections in Mexico are over, and the samples have not been read.

This is the part of the FDA advisory worth reading twice. On August 20, FDA said it had moved from the Taylor Farms de Mexico processing plant to the iceberg lettuce growers in the fields, which is where a waterborne parasite gets onto lettuce. The September 11 update says those onsite inspections and that sample collection, conducted with Mexican officials, have ended, and that the samples are pending analysis. The fieldwork is finished. The laboratory work is not, and nobody outside the agency knows how many samples were taken, from which fields, or when a result will be published.

FDA says its investigation remains open, and it has opened a second page for what comes after: a meeting with senior Mexican officials the week of September 8 on a prevention framework, a letter to industry asking for collaboration, and a promised update to its Cyclospora action plan. Every one of those is worth doing. Not one of them is a finding.

Whatever those samples show, a negative is the expected result.

Taylor Farms is already arguing the answer. Its Cyclospora information hub, last modified September 1, says epidemiologic evidence can point investigators toward a potential source but cannot confirm that a specific product caused illness, that confirmation requires a positive laboratory test of the product, and that the company’s own testing — roughly two thousand samples taken in central Mexico since May — has returned no positives. FDA answered that argument six years ago, in writing, to a different salad company. In the warning letter of October 20, 2020 that followed the Fresh Express bagged salad outbreak, FDA declared the product adulterated on the strength of epidemiologic and traceback evidence, with no positive product sample anywhere in the file. It then told the company exactly what its own negative results were worth: this parasite is not present in high numbers or spread evenly through a lot, and it is not uncommon to see many negatives even when contamination has occurred.

The science under that sentence is not in dispute. When Canadian federal scientists verified FDA’s own detection method, leafy greens spiked with ten oocysts tested positive thirty percent of the time. Seven in ten known-contaminated samples read clean. FDA’s 2013 assessment of this same plant put the infectious dose at ten to a hundred oocysts. A serving capable of putting someone in a hospital sits below the level at which a single sample reliably reports anything. The company’s own trade association tells consumers the same thing, that the absence of a positive sample does not mean the epidemiologic and traceback findings were wrong.

The company did not apply that standard to itself either. It recalled in July 2026 with no positive test in existence, and it suspended shipments from the same plant in 2013 with no positive test in existence. A sample count without a noun attached — two thousand samples of what, taken where, by what method, from which lots — is not a finding. I went through all of it here. The samples FDA carried out of Mexico this summer should be read the same way when they come back: a negative tells you what one 25-gram grab did not catch, and nothing about what 12,883 people ate.

FDA has open files on 312 of those 7,000 people.

FDA’s active investigation table, updated September 16, carries four Cyclospora investigations besides the lettuce outbreak. Together they account for 312 people.

Ref #PostedCasesOutbreak statusProduct linkedFDA steps taken
1392Jul 22234OngoingNot yet identifiedTraceback, sampling
1385Jul 838OngoingNot yet identifiedTraceback, sampling
1398Aug 522OngoingNot yet identifiedTraceback, sampling
1384Jul 818EndedNot yet identifiedTraceback only
All four 312 None 

FDA active investigation table, as posted September 16, 2026. Case counts are FDA’s. Reference 1390, the iceberg lettuce outbreak, is listed separately as ended with the investigation still open.

Against 7,000 confirmed illnesses with no attributed source, 312 is about one in twenty-two. Reference 1392 is 234 people, posted July 22, with traceback and sampling initiated and the inspection column still blank eight weeks on. Reference 1384 has ended, and it ended without a food ever being named. All four read Not Yet Identified.

Seven counters have gone quiet in three weeks.

CDC says it will stop updating weekly because recent infections have significantly declined, and will post periodically instead. Michigan moved to the first Thursday of each month and stands at 14,718 cases and 366 hospitalizations until October 1. Indiana called September 2 its final update until the official close of the outbreak, at 2,104. Virginia ended its weekly table on September 1 at 242. North Carolina moved to every other week on September 8 and does not report again until September 29. West Virginia closed its outbreak investigation outright on September 11, at 315 cases and 21 hospitalizations. Ohio has published no statewide number since 5,452 on August 13, thirty-five days ago.

CDC’s own page says illnesses from this season will keep arriving as they are identified, and that because of the unprecedented number of cases this year, illnesses from earlier in the season may keep coming in as well. The counting continues. The publishing has stopped.

What moved this week, and what did not.

North Carolina added eight cases, to 963 for the year and 32 hospitalizations, and its dashboard still says the increase there does not appear to be associated with the outbreak in other states involving Taco Bell, and that its patients have reported eating parsley and cilantro more often than a population-wide baseline would predict. Wake County holds 527 of them. Virginia’s last column changed for a different reason: the state says it is now in the multistate outbreak after verification of traceback data from CDC and FDA. Nothing else in the table moved, because almost nobody published.

Underneath the confirmed 19,883, CDC has 9,765 laboratory-confirmed cases still being sorted into domestic or travel-acquired and at least 6,594 more that are not laboratory confirmed or are awaiting an interview, which is how it reaches 36,242. Travel-associated cases, counted separately, are 2,078 with 74 hospitalizations. The median onset is still July 8, the latest still August 30.

Here is where all fifty states stand.

The Lettuce column is whether FDA has confirmed the recalled product reached that state. The last column is whether anybody has tied that state’s illnesses to Taylor Farms at all. Thirty-one states received the lettuce. Twenty-one are in the federal outbreak. Every count is a floor.

State2026 casesAs ofCDC Aug 27All of 2025LettuceTaylor Farms
Michigan14,718Sep 34,84650YesLinked
Ohio5,452Aug 132,67976YesLinked
Missouri2,152Aug 231,010none reportedYesLinked
Indiana2,104Sep 282327YesLinked
Illinois1,437Aug 18278301YesLinked
North Carolina963Sep 152300YesLinked
New York939Aug 170694YesUnknown
Kansas829Aug 2633129YesLinked
Kentucky819Aug 1232945YesLinked
Oklahoma556Aug 2524141YesLinked
Florida450Aug 150210YesUnknown
Iowa327Aug 2013064YesLinked
Texas315Aug 1120512YesLinked
West Virginia315Sep 111608YesLinked
Arkansas287Aug 258213YesLinked
Wisconsin284Aug 26065YesUnknown
Virginia242Aug 310115YesLinked
Nebraska218Aug 619951YesLinked
Pennsylvania214Aug 11244not notifiableYesLinked
Colorado150Jul 170205NoUnknown
Massachusetts147Aug 51874YesLinked
New Hampshire94Aug 25427YesLinked
Alabama85Aug 3019YesUnknown
Washington76Aug 280not availableMay haveTravel link
Maryland69Jul 170123YesNo link found
New Jersey46Jul 110180YesUnknown
Tennessee44Jul 16538YesLinked
California41Jul 140not availableMay haveUnknown
Minnesota41Jul 170none reportedNoUnknown
Connecticut35Jul 17041YesUnknown
Maine27Aug 7164YesLinked
Oregon23Jul 240not availableNoTravel link
Arizona19Jul 17049NoUnknown
Georgia11Jul 173116YesLinked
Mississippi7Jul 220not notifiableYesUnknown
Hawaii6Aug 260not availableNoNo link found
Alaska5Jul 1606NoUnknown
Rhode Island4Jul 1706May haveNo link found
South Dakota3Jul 1603May haveUnknown
Louisiana1Jul 17099YesUnknown
Utah1Jul 17037NoNo link found
Delawarenone published01May haveUnknown
Idahonone published0not notifiableNoUnknown
Montananone published08NoUnknown
Nevadanone published0not notifiableNoUnknown
New Mexiconone published09NoNo link found
North Dakotanone published04May haveUnknown
South Carolinanone published045YesUnknown
Vermontnone published03May haveUnknown
Wyomingnone published00NoUnknown
All fifty states33,556 11,458 3121

Counts as published by each state health department, compiled from the linked sources, as of September 17, 2026. Forty-one counted rows sum to 33,556; nine states publish no number. The CDC column is the last per-state outbreak split CDC published, on August 27, and sums to 11,458; CDC’s final September 11 update raised the outbreak to 12,883 without publishing a new state-by-state breakdown. State totals and CDC totals count different things and are not directly comparable.

What the season leaves behind.

Two people are dead. 1,064 have been hospitalized. The states willing to print a number printed 33,556 of them. The largest Cyclospora outbreak in American history is closed at 12,883, and 7,000 confirmed illnesses this summer still have no attributed source, with an open federal file on 312 of them. FDA’s inspectors have left the fields in Mexico and the samples they carried out have not been read. CDC has stopped publishing weekly. The lot-level traceability records that would let anyone walk this lettuce back to a field in days rather than weeks are not required until July 2028. Every count above is a floor.

The Food and Drug Administration sent its retail food specialists into 438 randomly selected grocery store delis between October 2019 and December 2022. In 84 percent of them, specialists saw at least one failure to hold food at a safe time or temperature. In 61.9 percent, an employee did not wash hands when or how the FDA Food Code requires. Those are the two headline findings of the agency’s technical report on foodborne illness risk factors in retail food store delis, published in August 2026 and reported this week by Food Safety News.

I read reports like this one differently than most people do. I represented the family of a man who died in the NetCost Market deli outbreak, and dozens of people in the Boar’s Head deli meat outbreak. I have sat with those families.

Why this report is personal

The NetCost outbreak ran from April 2021 to September 2022, inside the same window FDA was observing delis. CDC counted 16 people sick in six states. Of the 14 with information, 13 were hospitalized. One woman lost her pregnancy, and one death was reported, from Maryland. My client, a New Yorker, was one of the 16, and his Listeria was a whole genome sequencing match to the outbreak strain. He fell ill after eating deli products bought at two NetCost locations and died nearly a year later, too late to be included in CDC’s death count. Official outbreak numbers are a floor, not a ceiling.

New York officials found the outbreak strain in environmental samples from a NetCost deli in Brooklyn, in open packages of mortadella and ham sliced there, and in salami a sick person bought at a NetCost deli on Staten Island. The Brooklyn deli closed, was deep-cleaned and reopened after testing came back clean. In September 2022, the outbreak strain was found in that same deli again. CDC never identified a single deli or food as the source and concluded that a contaminated food likely carried the strain into delis in several states.

Two years later came Boar’s Head. CDC said in August 2024 that it had become the largest listeriosis outbreak since the 2011 Jensen Farms cantaloupe outbreak, in which I represented the families of all 33 people who died. CDC’s final count was 61 people sick in 19 states, 60 hospitalized and 10 dead. The people I represented in that outbreak included families of people who died.

Neither outbreak appears in FDA’s report, which names no deli and counts no illnesses. But when I read that 39.3 percent of delis did not properly clean and sanitize food-contact surfaces, I think of a Brooklyn deli where the outbreak strain turned up again after a deep cleaning.

What FDA measured

The visits were unannounced but voluntary and non-regulatory, and averaged about 101 minutes. Specialists scored ten Food Code practices grouped under four risk factors: poor personal hygiene, contaminated equipment, improper holding time and temperature, and inadequate cooking. A deli was marked out of compliance on a practice if a specialist saw it fail even once. FDA is careful to say that does not mean the practice failed every time.

This is the second of three rounds in FDA’s current Retail Food Risk Factor Study. The baseline round ran from 2015 to 2016, and the third runs from October 2026 through September 2027. FDA says it will not report trends until the third round is complete.

What FDA found

Holding food at the right time and temperature was the worst-controlled risk factor. Cold holding failed in 58.9 percent of delis, hot holding in 44.0 percent, and cooling in 41.9 percent of the delis where cooling could be observed. In 35.8 percent, refrigerated ready-to-eat food was not properly date-marked or discarded within seven days.

Personal hygiene came next at 61.9 percent, all of it from handwashing. In 55.7 percent of delis, someone failed to wash at a required time, and in 27.6 percent, someone washed improperly. Bare-hand contact with ready-to-eat food, by contrast, turned up in only 1.4 percent.

Contaminated equipment was found in 52.7 percent of delis. Food-contact surfaces were not properly cleaned and sanitized in 39.3 percent, and food was not protected from cross-contamination in 31.1 percent.

Cooking was the best-controlled risk factor, out of compliance in 9.3 percent of the 344 delis where it was observed. Only 37 of the 438 delis, 8.4 percent, had no failures on any of the ten practices. The median deli had three.

Why these failures matter for Listeria

FDA notes that most deli food is ready-to-eat and gets no cooking step to kill pathogens before it is eaten. The report does not test food for bacteria or count illnesses, and it does not tie any failure to any outbreak. Still, the practices that failed most often, including cold holding, sanitizing food-contact surfaces, and date-marking and discarding ready-to-eat food, are the practices that matter most for Listeria monocytogenes, which CDC warns can grow on food kept in the refrigerator. After the 2024 outbreak, CDC told businesses to follow USDA-FSIS best practices for controlling Listeria in deli areas.

What made delis safer

The strongest predictor of good performance was a well-developed food safety management system, meaning written procedures, training and monitoring. Delis with no such system averaged 4.37 failures. Delis with a well-developed, documented system averaged 1.95. FDA’s model estimates about 19 percent fewer failures for each one-point improvement on its four-point management scale.

Certified food protection managers helped, mostly by building those systems. Delis where a certified manager was the person in charge had an average management score of 2.87, compared with 2.27 where no certified manager was employed. Certification alone was not a significant predictor once management systems were taken into account.

Local rules mattered too. Delis in jurisdictions that required food handler training averaged 2.42 failures, compared with 3.19 where training was not required. Jurisdictions that graded establishments or required inspection results to be posted publicly also had fewer failures. Chain delis, which made up 95.2 percent of the sample, were far more likely to have well-developed management systems (47.6 percent) than single-store delis (9.5 percent).

One finding cuts the other way. More than three-quarters of the delis were in jurisdictions enrolled in FDA’s voluntary retail Program Standards, yet 67.9 percent of those jurisdictions did not meet Standard 1, the basic regulatory foundation. FDA’s supplemental analysis also found fewer failures in delis located in jurisdictions that were not enrolled. The report states that result without explaining it.

What the report cannot tell us

Participation was voluntary, delis under legal notice were excluded, and no deli is named, so the numbers may understate the problem. FDA did not measure whether food came from a safe source. The report is also internally inconsistent in one spot: it first attributes the holding failures to cold holding and cooling, then to cold holding and hot holding.

Timing is the larger problem. FDA announced the 2015-2016 deli report in May 2021. The 2019-2022 report arrived in August 2026, nearly four years after its data collection ended. Every observation in it predates the 2024 outbreak, so it says nothing about how delis changed afterward.

What should happen now

Deli operators do not need to wait for the next round. FDA released companion calls to action for industry and regulators that focus on using management systems to improve handwashing. The report’s own data point the same direction: write the procedures down, train to them, and check that they are followed.

State and local officials can require food handler training and public posting of inspection results, both associated with fewer failures in this study. FDA can report the third round far faster than it reported the first two. A trend line that arrives years late cannot help the families of people who get sick in the meantime.

People at higher risk, including pregnant women, adults 65 and older and anyone with a weakened immune system, should follow CDC’s advice to avoid deli meat or reheat it to an internal temperature of 165°F or until steaming hot.

Quick answers

What did FDA’s 2019-2022 deli study find? In 438 grocery store delis, 84 percent had at least one lapse in holding food at a safe time or temperature, and 61.9 percent had at least one handwashing lapse. Cooking was the best-controlled risk factor.

Is deli meat safe to eat? For most healthy people, illness from deli meat is uncommon. For pregnant women, adults 65 and older and people with weakened immune systems, CDC advises avoiding deli meat or heating it until steaming hot, because Listeria can cause severe illness.

What makes a deli safer? In FDA’s data, the biggest difference came from written food safety procedures, staff training and routine monitoring, backed by a certified food protection manager in charge.

Eggs contaminated with Salmonella have sickened more than 750 people in the United States and Europe so far this year, in at least eleven outbreaks, and two people in England have died. The causes are ones public health has understood for decades: bacteria inside the egg, raw or lightly cooked egg dishes in restaurants and delis, gaps in who has to follow the rules, and too much time between the first warning sign and the recall. The fixes are known, too.

The United States: three outbreaks, three very different farms

Midwest Poultry Services, Texas. The largest U.S. egg outbreak of the year was traced to Midwest Poultry Services, L.P. CDC counted 134 people sick in 18 states, 34 of them hospitalized and none dead, with illnesses starting between November 21, 2025, and August 12, 2026. FDA inspectors collected environmental samples at the company’s Texas operation, and three matched the outbreak strain of Salmonella Enteritidis by whole genome sequencing. The recall of more than 1.5 million dozen eggs on July 22 followed the company’s own third-party testing, which found the outbreak strain and was shared with FDA the day before. PulseNet flagged the cluster in April. Of the 134 people sickened, 99 fell ill between April 1 and the day before the recall, nearly three of every four cases. FDA said in July that Midwest Poultry did not account for all of the illnesses and has not named another source. CDC declared the outbreak over on September 3.

Happy Hens, Ramona, California. In San Diego County, an outbreak first tied to raw-egg mayonnaise at the deli in Ramona Family Naturals Market was traced to Happy Hens, a pasture-raised egg farm in Ramona. The count stands at 23 sick and seven hospitalized: 18 connected to the deli and five who got sick from the eggs themselves. FDA sampled the farm’s hen houses beginning August 17 and found Salmonella in two of seven, and genetic testing matched it to the people who were sick. State health officials recommended a voluntary recall on September 4. The farm recalled on September 8, and the public learned of the recall from the California Department of Public Health on September 11. A Happy Hens co-owner said in an Instagram video that regulators had fined the farm for selling checked, or cracked, eggs to the deli. Marler Clark represents seven people sickened in this outbreak.

Leaping Bear Farm, Reading, Vermont. Leaping Bear Farm recalled eggs in cartons dated June 1 through September 5 after state health and agriculture officials found Salmonella in eggs and environmental samples from the farm. Vermont has linked 14 illnesses to the outbreak, and officials say related cases have turned up in other states, without saying where or how many. The eggs were sold at farmers markets and other retailers. About 1,800 hens are involved, a number that matters for reasons explained below.

England: 549 sick, two dead, and imported eggs under investigation

The UK Health Security Agency is investigating three clusters of Salmonella Enteritidis that evidence suggests may be linked to imported eggs. As of September 7, England had 322 confirmed cases and one death in the largest cluster (t5.9411), 186 cases in the second (t0.24068), and 41 cases and one death in the third (t5.9765), for 549 in all. Scotland, Wales and Northern Ireland have reported more. In the largest cluster, patients range from infants to 90-year-olds, and 44 of the 176 with information available were hospitalized. Investigators have tied 47 cases to 11 businesses, mainly small cafés, restaurants and takeaways, and at least 24 of those people ate dishes containing egg. Two large importers are being investigated. The Food Standards Agency says there is no evidence implicating UK-produced eggs. The latest figures suggest new cases are slowing.

The largest cluster is not only British. The European Centre for Disease Prevention and Control reports 341 confirmed cases in Europe between May 2025 and August 2026, about 61 percent in the UK and 31 percent in the Netherlands, with others in Austria, Belgium, Denmark, France and Germany.

France: the same Polish egg group, again

Between May and July, France recorded four outbreaks of Salmonella Enteritidis ST11 tied to homemade mayonnaise, chocolate mousse and tiramisu. Eggs collected at patients’ homes carried strains matching the people who were sick. A French alert to the European Union’s rapid alert system counted 16 sick and four hospitalized. The European Food Safety Authority traced the eggs in all four outbreaks to two packing centres and three laying-hen farms in a single Polish food group, the same farms implicated in the multinational egg outbreak that reached 18 European countries between 2016 and 2020. One implicated batch was laid in a henhouse that had tested negative in December 2025 and again in January, April and June 2026. France suspended sale of the suspect eggs at the end of July. EFSA said the repeat findings suggest persistent contamination, or reintroduction, upstream in the production chain.

Spain: a tortilla left on the counter

In Eibar, 29 people got sick, nine of them hospitalized, after eating Spanish tortillas at one establishment on August 9. Inspectors cited insufficient cooking, tortillas stored at room temperature, weak egg traceability and cleaning, and the risk of cross-contamination. The eggs came from a farm in Aragon. Authorities ordered them withdrawn from other establishments and barred the distributor from marketing until it could show a working traceability and recall plan. Eggs and egg products were behind 131 of Spain’s 250 Salmonella outbreaks in 2024.

Why do eggs keep making people sick?

The bacteria are inside the egg. Salmonella Enteritidis can infect a hen’s ovaries and end up inside the egg before the shell forms. A clean shell is no guarantee, and neither is a clean barn test, as the Polish henhouse shows.

Raw and lightly cooked dishes turn one bad egg into an outbreak. Mayonnaise, mousse, tiramisu, runny eggs at a café and a tortilla left out all day appear on this year’s list.

The rules have holes. FDA’s Egg Safety Rule applies to farms with 3,000 or more laying hens, so Leaping Bear’s roughly 1,800 hens fall below the line. The rule requires prevention plans, environmental testing and refrigeration. It does not require vaccination.

Detection outruns action. Months passed between the PulseNet signal and the Texas recall. More than two weeks passed between San Diego County publicly naming Happy Hens and the state’s recall recommendation, then four more days to a recall and three more before the public was told. In Europe, a Polish group tied to an outbreak that ran from 2016 to 2020 is back.

What would prevent the next egg outbreak?

Vaccinate laying hens. The UK’s British Lion and Laid in Britain schemes vaccinate hens against Salmonella, and the Food Standards Agency considers those eggs very low risk, low enough that it says infants, pregnant people and older adults can eat them raw or lightly cooked. The United States should require vaccination, at a minimum for flocks that supply retail and food service.

Close the small-flock gap. A farm selling into grocery stores, delis and co-ops should meet the same prevention and testing rules as a large one, whatever the size of the flock.

Require pasteurized eggs for raw and lightly cooked food-service dishes. California already requires food facilities to use pasteurized eggs in foods such as mayonnaise under Health and Safety Code section 114012. Every state should. The FSA tells caterers who cannot verify where an egg came from to cook the dish thoroughly or use pasteurized egg.

Act on the epidemiology. When sequencing, patient interviews and traceback point to a farm, name the farm and get the eggs off the shelf. Waiting for an egg to test positive costs weeks, and FDA has mandatory recall authority under the Food Safety Modernization Act for firms that stall.

Finish traceability. Shell eggs are on FDA’s Food Traceability List under section 204 of that law, but compliance has been pushed back to 2028. Spain’s order barring a distributor until it proved it could trace and recall is worth copying.

Hold repeat sources accountable. When the same farms turn up in outbreaks a decade apart, pulling batches is not enough. EFSA’s call to find the root cause at the breeding and production level should be answered, and importers and buyers should demand the results.

Treat every egg as if it could be contaminated. Refrigerate eggs, throw out cracked or dirty ones, keep raw egg away from ready-to-eat food, and cook eggs until the yolks and whites are firm, especially for young children, older adults, pregnant women and anyone with a weakened immune system.

Salmonella in eggs is not a new problem, and none of these fixes is new. What 2026 shows is what happens when the tools we already have are used only halfway.