Fifty state health departments report 22,181 cyclosporiasis cases this summer. Two deaths are now reported in Michigan. CDC’s outbreak count is 1,947 across nine states, and it has not moved since July 24. CDC’s surveillance page, which counts illness rather than restaurant exposure, carries 6,707 laboratory-confirmed domestic cases through July 27 plus more than 11,500 additional cases it has not confirmed, spread across 45 states, with 423 hospitalizations. CDC treats May 1 through August 31 as the cyclosporiasis season. That leaves thirty days before the illnesses stop and the interest goes with them. Here is what still has no answer.

How many people have died, and how would anybody know? Every federal figure says none until today. I am not asserting otherwise. I am asking what method produced that number. A person with diabetes and heart disease who spends three weeks with a parasite, becomes dehydrated, is admitted, acquires something else in the hospital and dies in September does not get a parasite written on a death certificate. Cyclosporiasis has no reportable death definition that anyone has published, no matching against vital records that anyone has described, and no follow-up on hospitalized patients that anyone has announced. Zero was either a finding or an artifact of never having looked, and Atlanta should say which.

Why did the outbreak’s start date move, and how many people left the count when it did? FDA’s own page carries both versions. The July 16 update described 1,644 illnesses in five states with onsets from May 13 to July 13. The July 24 update described 1,947 illnesses in nine states with onsets from June 22 to July 20. The count went up by 303 while the front of the window moved forward almost six weeks, landing seven days before the recalled product began shipping. Four states were added in the same update, so a tightened case definition is a fair explanation. It is also an unstated one. Everyone who got sick between May 13 and June 21 left the outbreak, and no agency has said how many that was.

Were the other twenty thousand people ever screened against that definition? Subtract the federal outbreak count from what the states report and you get over 20,000 counted illnesses with no confirmed link to anything. CDC’s investigation page says not all of the implicated restaurants received shredded iceberg from the same supplier, which is an admission that sourcing varied. Nobody has said whether those nineteen thousand were interviewed, compared, or simply set aside because the people who got sick did not remember eating at a particular chain.

Do the two peaks in CDC’s own epidemic curve carry the same genotype? The curve CDC published on July 24 has two humps fifteen days apart with a trough between them. The ordinary explanation for a second hump is person-to-person spread, and this parasite cannot do that, because oocysts leave the body unsporulated and take one to two weeks in the environment to become infectious. A second wave therefore requires a second exposure event. CDC has run targeted amplicon deep sequencing on this organism since 2018 for exactly the purpose of separating clusters that look like one outbreak. This is an answerable question with an existing tool, and not a word has been published.

What is in the other five investigations? FDA’s own outbreak table has carried six Cyclosporainvestigations this season. One of them is the lettuce. Another was posted in late July with dozens of cases and no product identified at all, traceback ongoing. North Carolina, with more than seven hundred cases, reports parsley and cilantro coming up repeatedly in interviews and says many of its patients ate neither. Alabama has described two restaurant clusters and said in writing that they were not Taco Bell. FDA’s own people have said this lettuce is unlikely to be the only product making people sick. Which raises the obvious question nobody in government has answered out loud: what else is out there, and when will it be named?

Where else did the recalled lettuce go? The recall covered twenty-eight states. The outbreak count covers nine. The public list of who received the product is a set of customer abbreviations, and the only reason anyone knows Walmart was one of them is that Walmart said so to a reporter. The House Oversight ranking member has demanded the full retailer and restaurant list with a response due August 10. That is a question a company should have answered on July 17 without being asked.

What shipped before June 29? The recalled foodservice product moved between June 29 and July 16, and the recalled retail bags carry best-by dates from July 18 through August 3. Taylor Farms de Mexico was not shipping iceberg for the first time on June 29. Shredded lettuce runs about two weeks of shelf life, so everything that left that plant in May and the first three weeks of June was eaten or thrown away before anyone drafted a recall notice. A recall reaches only forward from the day somebody notices. The people who got sick first ate the evidence, and no one has asked the company to account for what it shipped before the window opens.

Did the 2013 sampling program ever run, and what did it find? When the same company suspended production at the same Guanajuato plant during the 2013 Cyclospora outbreak, it reopened on August 25 with FDA’s concurrence on a stated condition: a comprehensive sampling program covering products and water, plus continued monitoring of sanitary conditions at the facility. Thirteen years later the company’s defense is that no product sample has ever tested positive. Whether that program ran, for how long, how many samples it took and what it showed are questions with a paper answer somewhere.

Has anybody sampled the water? FDA’s 2013 environmental assessment recommended that this firm determine whether Cyclospora is a reasonably likely hazard in the Guanajuato growing region and, if so, re-evaluate the wash step. That is a standing obligation, not a one-time chore, and the plant has roughly doubled in size since. There is a public thermal bathing complex operating about eight hundred feet from that facility, and it was there in 2010, three years before the assessment. The published assessment covered the plant and five ranches. Nobody has said whether anything else in that watershed was ever in scope, then or now.

What is Mexico doing? In 2013 the investigation was run jointly with COFEPRIS, SENASICA and Guanajuato state health authorities. In 2026 there is no published Mexican case count, no Mexican agency statement, and no indication of whether anyone on that side of the border is investigating a parasite that lives in human waste and appears to be entering a food supply somewhere in central Mexico. Every document in this outbreak is American. The contamination is not.

Were the harvest workers sick? The 2013 assessment tabulated prescriptions written for harvest crews and found the antibiotic combination used to treat cyclosporiasis being dispensed during the outbreak window, though no diagnoses appeared in the records FDA inspected. That finding proves nothing standing alone and I have said so. It is also the single most direct question anyone could ask about the source of a fecal-oral parasite, and in 2026 nobody has asked it. What did worker illness look like at that facility this spring, was anyone tested, and what are the toilets and handwashing stations in those fields today?

What happens to the patients who cannot take the only recommended drug? Every treatment guidance names trimethoprim-sulfamethoxazole. A meaningful share of the population cannot take a sulfa drug. Two of the four clients whose cases we have filed are sulfa-reactive; both were prescribed nitazoxanide instead; one of them could not obtain it, because it was on backorder in Michigan and in other states, and her husband drove roughly seven hours to fill it. She was hospitalized, transferred, and her physicians discussed an intensive-care desensitization procedure. At more than twenty-one thousand counted illnesses, several hundred Americans are in that position right now. Nobody at FDA or CDC has said a word about second-line treatment availability.

What does this illness actually leave behind? The produce industry’s consumer FAQ states that outcomes are generally favorable even in immunocompromised patients and that no significant long-term health consequences have been reported. I would like to know what study that rests on. Untreated cyclosporiasis relapses, runs for weeks, and in the patients I have talked to this summer it has run far longer than the tidy description in the literature. No one is following this cohort. The federal government’s own cost estimate values a case of this disease at four hundred sixty-five dollars, which is a number that can only survive if nobody checks what happens to people in month three.

When did Taco Bell first hear from sick customers? Store-level signs went up in Michigan in early July saying the restaurants could not serve lettuce, cilantro, onions, pico de gallo or guacamole. On July 14 the company told reporters that public health officials had not confirmed a link to Taco Bell or any ingredient, supplier, restaurant or retailer. Both things were true at once. Product does not come off a prep line for nothing. The date the company first had enough information to act exists, in a guest-relations ticketing system and in a decision memo, and it has never been made public.

Why is any of this being answered in litigation instead of by a public agency? That is the question underneath all the others. The 2024 romaine outbreak that killed one person and hospitalized thirty-six is known to involve this company only because we sued and posted the unredacted pages. A parasite outbreak that has now counted more people than the entire national annual estimate should not depend on a plaintiffs’ lawyer with a subpoena.

Seven members of Congress have written letters about this outbreak. Not one has been publicly answered. One deadline falls on Monday and another on August 10. The season closes August 31, and in 2013 the same parasite from the same valley produced an investigation that ended without an answer and stayed that way. Thirty days from now the case counts will flatten, the reporters will move on, and every one of these fifteen questions will still be sitting there unless somebody makes them expensive to ignore. I have written down what I think ought to be done. Answering the questions comes first.

This morning I posted that the fifty-state count was 21,913 and that Michigan was the only state that had moved. That was true of Monday. It was not true of the table. I went back through all fifty states one more time this evening, and two of them were carrying numbers that were badly, embarrassingly wrong. Neither of them moved today. Both of them moved a week ago and I did not catch it.

Iowa is not at 57. Iowa’s own weekly report, published by the Center for Acute Disease Epidemiology and last updated July 30, puts the state at 226 laboratory-confirmed infections in 48 of its 99 counties, with 47 patients reporting international travel. The same report carries a five-year series that ought to be read out loud somewhere: 53 cases in 2022, 52 in 2023, 62 in 2024, 69 in 2025, and 226 so far in 2026. One season in Iowa is larger than the previous four seasons combined, and it is happening in a state nobody has been watching.

Wisconsin is not at 61. The Wisconsin Department of Health Services reported 160 cases as of July 29, including three hospitalizations, and fifty of those were in people who did not travel outside the United States in the fourteen days before symptoms began. Wisconsin posts a new figure every Wednesday, and the trajectory is right there in the archive: 35 cases on July 9, 61 on July 15, 105 on July 22, 160 on July 29. The state has said plainly that it has found no common food product among its domestic cases and that it has no active outbreak. Fifty domestically acquired infections in a state that normally sees twenty to thirty in an entire season is still fifty people who got this from something they ate here.

Both of my numbers came from the same place: a single national roundup published on July 17 that collected figures by emailing state health departments. That roundup was accurate the day it ran. The failure is mine. Thirteen states in my table trace back to it, and until tonight I had not gone back to ask whether any of those states had since started publishing their own running counts. Two of them had. Iowa was off by 169 people and Wisconsin by 99.

I am writing that plainly because it is the same failure I have been describing at the federal level for three weeks, one floor down and in my own house. A number gets published. It gets picked up. It travels on its own momentum long after the thing it describes has moved. CDC’s 1,947 has been doing that since July 24. A July 17 roundup was doing it inside my own table, and the only reason I found it is that I went and looked at what the states themselves were saying.

The corrected fifty-state total is 22,181. Against the 18,207 people the federal government describes when you add its two published figures together, the two counts are now 3,974 apart, which is 21.8 percent of the federal base. The nine-state outbreak, at 1,947 people, is 8.78 percent of the illness this country is reporting. Every one of those gaps got wider tonight without a single new person getting sick, which is the whole point.

Eleven of the thirteen roundup states are still standing where they were on July 17, and I want to be precise about what that means. Colorado, Maryland, Massachusetts, Minnesota and Nebraska gave their figures to that outlet by email and do not appear to publish a running count anywhere a member of the public can find one. Minnesota’s 41 looks like it is still right — the state has said its cases are sporadic and not at concerning levels. For the rest, the number in my table is the last number the state said out loud, and it is seventeen days old. That is not the same as saying it is wrong. It is saying nobody knows, including the people who live there.

Nothing else moved. Michigan holds at 11,234 with 193 hospitalizations and the two deaths announced this morning. Indiana never posted a Monday figure and stays at 1,176. The Toledo-Lucas County dashboard, which had been producing a northwest Ohio count almost every day, has now gone three days without one, so that region is still carrying Friday’s 3,016. Virginia’s Monday morning update never appeared. Missouri’s weekly Sunday update never appeared either, which leaves its 593 eight days old and the stalest figure among the nine outbreak states.

One caution on Virginia. A national outlet reported today that Virginia stands at 162 as of July 23. My table says 126 as of the same date, and 126 is what the state’s own components add up to — 66 domestically acquired, 31 travel-associated, 29 still pending. I tried to settle it against the health department’s own page and was served a version of that page from 2019. Until somebody reads the live table, Virginia stays at 126 here. I would rather carry a number I can reconstruct than one I cannot.

That same article is worth a moment on its own. It went up this morning at 10:02 Eastern under the headline that cyclospora cases are still rising, and it tells readers that no deaths have been reported and that Michigan has 10,773 cases. Michigan had published 11,234 at 9:30 that morning, thirty-two minutes before that piece went up, and 10,773 was Friday’s number. Its timestamp shows it has not been touched since the second it was published. Two people had died, and the piece explaining where the outbreak is growing has stood uncorrected all day.

Where each state stands tonight, with the source for every number.

Thirteen states in that table publish no count of their own. CDC says 45 states have cases, which means there are at least nine states where the federal government knows there are confirmed illnesses and a resident cannot look up how many. Eleven more of these numbers still trace to that July 17 roundup.

I have said all summer that every figure in this table is a floor. Tonight is the clearest demonstration of it I have had. I did not find 268 new patients this evening. I found 268 people who were already sick, already counted by their own states, and sitting in my table at a fraction of their number because I was reading a roundup instead of reading Iowa and Wisconsin. Twenty-eight days remain in the season. I would encourage every reporter working this story to go pull the state reports themselves, and I would encourage the eleven remaining states to publish something a person can read without sending an email.

Two people are dead. The Michigan Department of Health and Human Services said so on Monday morning, August 3, and they are the first deaths anywhere in an outbreak that began in May and has now been reported by all fifty states.

Here is the whole of what Michigan said. Two deaths have been identified as part of the cyclosporiasis outbreak affecting the state. According to medical records, both individuals had significant underlying health conditions that may have been impacted by cyclosporiasis and dehydration. No additional information will be provided on these two cases. Cyclosporiasis is generally not a life-threatening illness, and death resulting from it is uncommon in the United States.

May have been impacted by is contributory language. It is not a cause-of-death finding, and I am not going to write that this parasite killed two people when the health department has not said that. What I will say is that this is exactly how foodborne deaths in medically fragile people read on the page — a serious underlying illness, a diarrheal infection, dehydration, and a death that could be entered a dozen different ways depending on who fills out the certificate. That ambiguity is not a reason to discount these two. It is the reason deaths from this kind of illness are undercounted everywhere.

The same Monday morning update moved Michigan’s count to 11,234 cases, up 461 from the 10,773 the state reported on Friday. Hospitalizations held at 193, which is still the previous Thursday’s figure, because Michigan refreshes that number weekly.

That takes the fifty-state total from 21,452 to 21,913, against the 18,207 people the federal government describes when you add its two published figures together. The two counts are now 3,706 apart. The gap has passed twenty percent of the federal base for the first time since I started keeping this table. The named nine-state outbreak, at 1,947 people, is 8.89 percent of the illness this country is reporting.

The federal government moved on Monday for the first time since July 24, and it moved on this and nothing else. CDC’s investigation page now states that it is aware of two cyclosporiasis-related deaths in people with underlying health conditions from Michigan as part of this outbreak, and that it will update its website to include laboratory confirmed cases, hospitalizations, and deaths. Read that second sentence again. It is a promise to update rather than an update. The case count on that page has not changed. The FDA advisory is still stamped July 24 and still carries a line reading Deaths: 0, which is now contradicted by a sister agency on the page it links to.

There is a question buried in the phrasing that matters more than it looks, and I am asking it rather than answering it. CDC says the two deaths are part of this outbreak, and on that page this outbreak means the nine-state Taco Bell cluster of 1,947 people. Michigan says they are part of the cyclosporiasis outbreak affecting Michigan, which is 11,234 people. Those are not the same denominator. They differ by a factor of about six. Whether these two people are inside the federal 1,947 or inside the state’s 11,234 changes every fatality rate anyone tries to calculate this week, and neither agency has said which it is.

Ask yourself how a third death would be found. It would be found the way these two apparently were, which is that somebody who already knew a patient had cyclosporiasis went and looked at what happened to that patient afterward. In a state with 11,234 cases and 193 hospitalizations, that is a manageable exercise. In the other forty-nine states, where nobody is systematically reviewing death certificates for a parasite that would rarely appear on one, it is not being done at all. Zero deaths has never meant zero deaths. It has meant that no one was looking.

These two deaths also land on a claim the produce industry has been making all summer. The International Fresh Produce Association’s consumer FAQ still tells the public that Cyclospora outcomes are generally favorable even in immunocompromised patients and that no significant long-term health consequences have been reported. I do not think that FAQ was written in bad faith. I think it was written before anybody had bothered to look at the severe end of the curve, and it should be rewritten today.

One more thing surfaced in Monday’s coverage that has not been part of this story until now. The Windsor-Essex County Health Unit in Ontario is urging its residents to take precautions when travelling to Michigan. It has identified twenty-four cyclosporiasis cases in 2026 against a typical year of about three, and its investigations found travel to Michigan to be a common exposure among many of the recent ones. A foreign health authority is now advising its citizens about crossing into an American state because of a lettuce parasite, which is a fair measure of where this has gotten to.

Michigan is the only state that moved today. I re-checked the other forty-nine this afternoon and not one of them has published a new figure since Friday. Four updates are overdue and none of them had landed when I compiled this. Virginia posts on Monday mornings with data through the prior Thursday. Indiana posts on weekday afternoons. The Toledo-Lucas County dashboard has no Monday figure, so northwest Ohio is still carrying Friday’s 3,016. Missouri’s weekly Sunday update never appeared at all, anywhere, which leaves its 593 eight days old and the stalest number among the nine outbreak states. CDC surveillance, North Carolina, Oklahoma and West Virginia all refresh on Tuesday. Every figure below is a floor.

Where each state stands tonight, with the source for every number.

Thirteen states in that table publish no count of their own. CDC says 45 states have cases, which means there are at least nine states where the federal government knows there are confirmed illnesses and a resident cannot look up how many. Thirteen more of these numbers trace to a single national roundup that has not been updated since July 17.

Twenty-eight days remain in the season CDC defines as running from May 1 to August 31. When it closes, the counts flatten, the reporters move on, and this becomes another Cyclospora outbreak that ended without an answer, the way 2013 did. The difference now is that two families are on the other side of the arithmetic. A death is the point at which an argument about counting stops being about bookkeeping. If the fifty states are right, and the federal number describes fewer than nine percent of the people who got sick, then the question of how many more there are is not an academic one.

A company’s public statement in the middle of an outbreak is not marketing. It is evidence — what the company said it knew, and when, published to the world at a moment when nobody had the benefit of hindsight. I have built cases on those statements since 1993. I have been reading and saving this one since the day the recall issued, and the sixteen days since are worth laying out end to end, because the words have moved a great deal and the substance underneath them has not moved at all.

Start with the original. On July 17 the company posted a statement that opened with the people who got sick — the ill, their families, and Americans whose trust in produce had been shaken. It said that trust took decades to earn. It said the removal of product was based on information FDA had provided the day before. And it said something that has not appeared in a single version since: that FDA’s traceback was pointing to a specific independent farm, described as less than one percent of the United States iceberg supply, as the potential source.

The recall was July 17. FDA reported a positive test on July 18. FDA retracted that result as a false positive on July 19. The July 17 statement therefore explains why the company pulled product at a moment when no positive laboratory result existed anywhere in the world, and the reason it gives is FDA’s traceback and the epidemiology. That is a party admission, and nothing published afterward reaches back and unsays it.

Two days later the same address served a different document. The July 19 version led with the assertion that FDA had apologized to the company. Sympathy for the sick moved from the first paragraph to the fourth and got shorter. The recall was recast in the completed past tense and attributed to an abundance of caution. The acknowledgment about the specific farm was gone. I wrote that night about how the victims ate the evidence in May, and I have not changed my view since.

There was no apology. I went looking for one in FDA’s July 19 update and what is there is a laboratory correction and a notification to the firm — and in the same paragraph, a statement that FDA continues working with the firm to ensure product implicated in this outbreak has been removed. The word implicated survived the false positive. The next day FDA answered in public without naming anybody: the false-positive sample does not change the basis for the investigation or the overwhelming epidemiological data supporting the recall, and traceback and outbreak data continue to converge on shredded iceberg lettuce from Taylor Farms locations in central Mexico. Note the plural locations. The company had described one independent farm at less than one percent of supply and then stopped describing it at all.

By July 24 the page had been rewritten again, this time leading with money — more than two hundred million dollars a year in independently audited food safety protocols — and reporting that sourcing and central-Mexico production had been suspended since July 18 and independent experts commissioned for a top-to-bottom review. The apology claim was simply absent. No correction, no note, no acknowledgment it had ever been there.

On July 30 the company built something new, a Cyclospora information hub at its own address, and the old newsroom link now redirects there. It was revised again on July 31, and that revision created a problem. The FAQ list of states that received recalled product now runs to twenty-eight and includes West Virginia, which FDA added a week earlier. The distribution paragraph higher up the same page still lists twenty-seven and still leaves West Virginia out. West Virginia is one of the nine states in the federal outbreak. 

Now. All of that is about words, and I have spent enough of this outbreak on words. Here is the substance the words have never touched, in sixteen days and five versions.

This is not the first time, and the record of it is long. In the summer of 2013, cyclosporiasis sickened 631 people across twenty-five states. Iowa and Nebraska accounted for 239 of them, and epidemiologic and traceback work by those two states, CDC and FDA tied their restaurant cases to bagged salad mix produced by Taylor Farms de Mexico in Doctor Mora, Guanajuato, and served at Olive Garden and Red Lobster. I want to be exact here, because the number gets misused: the Texas cases that summer were tied to cilantro from an unrelated producer, and the cause of more than a hundred other illnesses was never determined. The salad mix link is to Iowa and Nebraska.

FDA then published an environmental assessment of the processing plant and five ranches. Investigators analyzed roughly 835 product, water and environmental samples, including more than 269 human fecal samples collected from sanitary facilities on the ranches, and recovered the parasite from none of them — the assessment began five weeks after the last known illness. What survives from that document is its second recommendation, which told the firm to determine whether Cyclospora is a reasonably likely food safety hazard associated with the Guanajuato leafy green growing region, and if it is, to re-evaluate the wash step. That was November 2013.

There is one more piece of the 2013 record, and it goes directly to the testing question. The company suspended shipments to the United States on August 9, 2013, and resumed them on August 25 with FDA’s concurrence. FDA said at the time that its decision rested in part on the environmental assessment and in part on its review of a product sampling plan for Cyclospora that Taylor Farms de Mexico had put in place. A sampling plan for this parasite, reviewed by a federal agency, as part of the price of reopening a plant — thirteen years ago. I have gone looking for a single published result from it and I have not found one.

Reasonably likely hazard is not casual language. It is the vocabulary of hazard analysis, and the company’s own hub says its processing facilities operate under the FSMA preventive controls rule — under which a hazard requiring a preventive control brings monitoring, verification and records along with it. Meanwhile FDA’s own fact sheet for farmers carries a footnote listing where cyclosporiasis is endemic: Bangladesh, Brazil, Chile, China, Cuba, Dominican Republic, Egypt, Guatemala, Haiti, India, Indonesia, Jordan, Mexico, Morocco, Nepal, Nigeria, Pakistan, Peru, Puerto Rico, Romania, Saudi Arabia, Tanzania, Thailand, Turkey, Venezuela, Viet Nam and Zimbabwe. Mexico is on that list and has been for years.

The question, then, is not why you did not test. The question is what your hazard analysis says about this parasite. If you identified it as a reasonably likely hazard, produce the preventive control, the verification activity and the records. If you concluded it was not a reasonably likely hazard, explain the basis for that conclusion — thirteen years after a federal agency told you to make the determination, in a country that same agency lists as endemic, at the same plant, growing a ready-to-eat product with no kill step. I cannot construct an answer that survives both versions of the question.

The same fact sheet tells farmers to assess water systems and adjacent land for sources of contamination, and it names sewage and septic systems and land application of wastewater. The hub lists adjacent land review as part of the company’s ranch inspections. Good. There is a public swimming resort roughly eight hundred feet from the Doctor Mora plant, and satellite imagery shows it operating there years before the 2013 assessment was written. What did the adjacent land review record about it? 

Which brings me to the testing, and to the number the company has put at the center of its defense. The hub says that as of July 24 FDA had no confirmed positive product test results, and that the company’s own testing — approximately two thousand samples taken in central Mexico since May — returned zero positives. I want to be precise about what that does and does not show, and I want to be fair about what the company actually claims.

On water, the company describes its own program in seven words: water sources are tested for indicator organisms. FDA’s fact sheet says that traditional microbial testing, meaning fecal indicators like generic E. colior fecal coliforms, will not identify the presence of this parasite. FDA also says — and I will give the agency the rest of its sentence — that indicator testing may help identify poor water quality, which may itself be a sign of human fecal contamination. Indicators are not useless. They are a proxy. But a proxy for fecal loading is not a test for the organism, and this organism’s only reservoir on earth is human feces.

On product, the company says more. It says it uses the latest FDA-validated testing method for Cyclospora, which means FDA’s Bacteriological Analytical Manual Chapter 19b, published in June 2017 and since extended to matrices including romaine lettuce. There is a companion method, Chapter 19c, published in 2020, for agricultural water — validated to detect roughly six oocysts in ten liters. Both have existed for years. The honest statement, then, is not that this company never tested for the parasite. It is that the water program, by the company’s own description, was never aimed at it, and that the product testing it did do cannot bear the weight now being placed on it.

Here is why. The Canadian Food Inspection Agency independently verified FDA’s produce method and published the results. Leafy greens spiked with two hundred oocysts were detected ninety-three percent of the time. A 2023 modeling study in the Journal of Food Protection says the same thing in the federal register of the scientific literature: these methods have been shown not to always detect contamination when present at low levels.

Apply that to two thousand samples and the number stops being impressive. It is not evidence that the product was clean. It is evidence that a method with a thirty percent detection rate, run against an unknown fraction of an enormous volume of lettuce, mostly after the contamination window had already closed, found nothing. 

FDA says its traceback and its outbreak data converge on shredded iceberg lettuce from this company’s locations in central Mexico. The company says its own two thousand samples found nothing. Both of those can be true at once, and if they are, the conclusion is not that the lettuce was clean. The conclusion is that the testing program could not find what was in it. Negative results from a program that cannot detect the hazard are not exoneration. They are a description of the program.

The company’s position is that epidemiology can identify a potential source but that only a positive laboratory test can confirm a specific product caused illness. Fine — that is a defensible view of proof, and plenty of scientists hold it. But a standard that strict about positives has nothing at all to say about negatives. If a positive is the only thing that counts, then two thousand negatives count for nothing too, and the company cannot cite them as if they did.

One last item, and it closes the circle back to 2013. The posts says the company’s teams invented a wash system that is tested and verified by USDA and describes custom spin dryers and consistent wash-water chemistry. That is a wash step, validated against bacteria, for an organism against which no wash step and no chemical treatment has ever been validated — FDA says in its own voice that chlorine and other common antimicrobial treatments are not effective on it. FDA told this facility to re-evaluate its wash step in 2013. Thirteen years later the wash step is on the website as a credential.

I do not fault a company for defending itself, and I do not fault it for updating a page as facts change. What I fault is a record that moves without saying it moved, while the questions that actually matter stay untouched underneath it. Five versions in sixteen days, an apology asserted and quietly dropped, a traceback acknowledgment removed and later restored, a state list that answers its own question two ways on one screen — and in all of it, not one sentence about what changed at that plant after 2013.

Two committees in Congress have asked this company for documents by August 10 and August 13. If I had one request to add to theirs, it would be short. Produce the hazard analysis. Produce the water testing records and say what organism they were looking for. Produce the adjacent land reviews for the Doctor Mora ranches. And produce the 2013 file, the one that answers whether this parasite was ever treated as a reasonably likely hazard at a plant in a country FDA calls endemic. Everything else on that website is a claim. 

I tried to stay away from Cyclospora today.

Saturday is the one day of the week when nothing moves. The health departments that report daily do not report on weekends, CDC’s outbreak page has said 1,947 illnesses and 98 hospitalizations since July 24, and the fifty-state total I keep sat at 21,452 from Friday afternoon straight through to dinner. A day off, I thought. Then I ordered a salad, and here I am at the keyboard.

What sent me back was not a case count. It was a study a private company published on July 30 that nobody in Atlanta or College Park has matched. Truveta is a Seattle outfit owned by a consortium of American health systems, and it sits on the electronic health records those systems generate. Its research arm went and looked at every healthcare encounter carrying a cyclosporiasis diagnosis from January 1, 2018 through July 27, 2026, counting each patient once per illness episode.

Here is what they found. In July 2026, the rate of cyclosporiasis diagnosis reached 10.5 per 100,000 people who had a healthcare encounter that month. The average July rate across 2018 through 2025 was 0.9. That is an eleven-fold increase over the historical average, and more than eight times the worst July anywhere in the eight-year series, which was 1.2 per 100,000 in 2018.

Understand why that particular number matters, because it is the answer to an objection I have been handed at least a dozen times this month. Every time I write about the scale of this outbreak, somebody in the industry explains to me that it is an artifact of better testing. Multiplex PCR stool panels have been spreading through American labs since 2014, they say, and a parasite that was invisible for decades is finally being seen. There is truth in that, and I have said so. But it explains a trend line, not this. Truveta is measuring a rate, and the denominator is people who walked into a healthcare setting. A wider installed base of panels can bend a curve over ten years. It cannot make July 2026 eight times worse than the worst July in the same dataset, drawn from the same health systems, coded the same way.

The severity numbers are the other half, and they are the part I did not expect. Twenty-two percent of patients with a cyclosporiasis diagnosis had an emergency department visit within two weeks of that diagnosis. Nearly one in eight, 11.9 percent, was hospitalized. Among adults sixty-five and older the hospitalization rate was 19.4 percent, against 9.9 percent for everyone younger — almost double.

Now set that beside what the produce industry is telling consumers. The International Fresh Produce Association’s consumer FAQ on Cyclospora says outcomes are generally favorable even in immunocompromised patients, and that no significant long-term health consequences have been reported. I will set that claim against a number: one in eight of the people who got this diagnosis went into a hospital bed.

Truveta is a commercial data company, not a public health agency, and this is a research blog post that is preliminary and not peer reviewed. Cases were identified by diagnosis code, not by laboratory confirmation, so this is not CDC’s case definition, and the two counts are not interchangeable. Most important, the population is people who sought care and got diagnosed, which skews toward more severe illness. That is almost certainly why 11.9 percent is roughly double the federal ratios — 98 hospitalizations among 1,947 outbreak cases is 5.0 percent, and the 423 among 6,707 lab-confirmed cases on the surveillance page is 6.3 percent. Truveta states every one of those limitations in its own write-up, which is more than can be said for some of the numbers circulating in this outbreak. It adds one more: July data were incomplete when the analysis ran, so the July rate is likelier to be too low than too high.

One finding has stayed with me all evening. Most of those emergency department visits happened before or on the day of diagnosis. People were already in acute care before anyone knew what they had. That is the reporting lag seen from inside the exam room instead of from the epidemic curve — the patient is dehydrated and frightened in an emergency department while the stool specimen is still in transit, and the case will not reach a state count for weeks after that. Diarrhea showed up in 74.6 percent of these patients, abdominal pain in 23 percent, nausea or vomiting in 18.8 percent, dehydration in 6.3 percent. The clinical picture is exactly what CDC describes, and it can run for weeks untreated.

Here is what bothers me about the whole thing. We now have four parallel counting systems for one outbreak. Fifty state health departments publish 21,452 cases between them. CDC’s surveillance page publishes 6,707 lab-confirmed plus more than 11,500 awaiting confirmation or further analysis. CDC’s outbreak page publishes 1,947 and has not moved that number in more than a week — through a Friday on which Michigan alone added 387 cases. And a private company a ferry ride from my office, with no statutory duty to anybody, turned around a severity profile in a matter of days that no federal agency has produced in three months. Truveta did not do anything heroic. It queried a database.

The season CDC recognizes runs May 1 through August 31. There are thirty days left in it, and when it closes the counts will flatten and the reporters will go home, and the question of what made all these people sick will still be open.

I finally ate the salad. It was cold by then, and it was fine. It was also grown somewhere by someone, washed with something, in water that came from somewhere, and there is not a person in this country who can tell me whose it was. That is not a consumer problem. Washing will not fix it, and neither will a list of foods to avoid. It is a traceability problem, a water problem, and a counting problem, and every one of those is fixable by people who have chosen not to fix it.

I laid out eight things last Friday morning on FSN that Washington should have done about Cyclospora. The obvious objection to a list like that is money — that food safety is expensive, that budgets are finite, that somebody has to pay for it. I want to take that objection seriously, because when you actually put the numbers side by side, it collapses. The eight things are cheap. What happened instead is not.

Start with what the federal government itself says this parasite costs. USDA’s Economic Research Service publishes a cost-of-foodborne-illness estimate covering thirty-one pathogens. Cyclospora cayetanensis is one of them, and its line reads: 11,407 cases a year, $464.63 per case, $5.3 million a year for the entire United States.

The Microbiological Data Program, which tested about fifteen thousand produce samples a year — bagged lettuce and spinach, cilantro, hot peppers, tomatoes, sprouts, melons — and accounted for something like eighty percent of all federal produce pathogen testing until it was shut down in December 2012. It cost $4.5 million a year. The entire national testing program cost less than what one parasite costs the country annually, and I have been asking for it back since 2024.

Four things are wrong with the $5.3 million. First, the 11,407 is Elaine Scallan’s 2011 figure, unchanged — ERS’s dollar estimate is riding on a fifteen-year-old case count. Second, ERS says plainly on its own page that these numbers are conservative because they exclude willingness to pay to prevent non-financial harm, including pain and suffering. For an illness that relapses in waves across weeks, that is most of the injury. Third, they exclude industry losses entirely. No restaurant sales. No lettuce. No recall. And fourth, they do not contain a dollar of what it costs to fight about any of it.

Then it produces a summer like this one. The fifty-state count on Friday afternoon was 21,452 people, which is 1.88 times ERS’s estimate of every Cyclospora case in a normal year. Run only the counted cases at ERS’s own per-case cost and you get $9.97 million — already nearly double the agency’s entire annual national figure. Run the Scallan-adjusted estimate of 557,352 illnesses and you get $259 million. Both are floors, because neither includes a dollar of what follows.

Here is what follows. Yum Brands reported Thursday that Taco Bell’s US same-store sales are down 2% for the third quarter through July 27. Its stock has fallen roughly five to eight percent since the chain was linked. On Friday July 17, the first Friday after the link became public, Taco Bell’s foot traffic fell about sixteen times worse than the broader fast-food category, which was down 1.9% that day.

And the damage did not stop at the company with the lettuce. Chopt was down 12% in traffic as of July 23. Sweetgreen’s weekly spending fell ten percentage points against last year across the first half of July. Sweetgreen has said its food is not linked to this outbreak, and no state has tied an illness to either chain. They lost the money anyway. Grocery shoppers are buying less lettuce, and some large buyers have stopped sourcing from central Mexico altogether.

Go one step further back and it reaches the grocery store. Stew Leonard’s runs eight stores across New York, New Jersey and Connecticut, and its chief executive told CBS News that lettuce sales are down about eleven percent and that there is “a lot of confusion on store floors right now.” Behind that anecdote is the scanner data: NielsenIQ recorded US fresh lettuce unit sales in the week ending July 18 down nine percent from the week before and nineteen percent from two weeks before.

And one step further back still, to the growers. Paul Sellew founded Little Leaf Farms, which grows lettuce in the eastern United States — not Mexico, not Salinas, no connection to Taylor Farms or to any recalled product. His sales are down by double digits. His account: “The consumer has been motivated by fear.” He also says the entire fresh produce category at retail is down. A grower two thousand miles from Guanajuato is paying for Guanajuato.

The trade associations have said very little about any of this, and one of them said something more useful than it may have intended. The National Restaurant Association now tells its members that washing produce under clean running water “cannot guarantee removal of the parasite.” That is the restaurant industry’s own trade group putting in writing exactly what the White House press secretary told the country to do on July 16, and it joins FDA’s guidance document and CDC’s health advisory in saying so. Three sources. One of them had every commercial reason to say something else. What no trade association has done, more than six weeks in, is put a number on what any of this has cost its members.

One publication did say something useful this week, and it came from a direction that carries more weight than mine. On Friday the editorial board of the Delmarva Farmer, a paper written for the people who grow this food, called for exactly the traceability infrastructure that has been shelved. Its account of the harm is better than the one I have been making. Food moves in hours while outbreak investigations take weeks, and in that gap, retailers turn cautious, buyers hesitate, whole commodity sectors watch sales fall, and growers who followed every protocol lose their market because they happen to raise the same crop as the eventual suspect. Its prescription is electronic purchase records, standardized lot coding, interoperable supply-chain databases and real-time data sharing — which is the contents of FSMA 204, described by a farm paper without the rule’s name attached to it. It observes that agriculture has spent billions over two decades on water testing, worker training, sanitation and third-party audits, and argues those investments deserve to be matched by equally modern systems for detection and traceback. It closes by saying it is “time for the public health infrastructure that protects it to catch up.”

That fourth exclusion is the one I know best, because it is my job. The ERS figure holds nothing for what Taylor Farms will spend defending these cases — the lawyers, the experts, the document review, the depositions, the years of it. It holds nothing for what my side spends building them. And it holds nothing for what eventually reaches the person who was sick. Look at what the money is paying for. It is paying for precisely the pain and suffering that ERS declined to value and said so. The tort system puts a price on the one term the cost-of-illness model leaves deliberately blank. The two numbers are not in conflict; one of them is measuring the part the other refused to measure.

The legal fees are money spent establishing who is responsible for something that should not have happened, which buys nobody a single healthy day. And there is a hard public number for it. After the 1993 outbreak, Jack in the Box sued its own meat suppliers and recovered about $58.5 million. Its annual report to the SEC records that roughly $45.8 million of that was left after litigation costs. Nearly thirteen million dollars, consumed by one recovery action arising out of one outbreak, and not one cent of it made anybody well. That is a line-item ERS does not have, and it recurs in every outbreak, on both sides, every time.

As for scale, my first case is still the clearest illustration I have. Brianne Kiner spent forty-two days in a coma and more than five months in the hospital, and her case settled for $15.6 million in 1995. One child. One settlement. Nearly three times what the federal government today says Cyclospora costs the entire United States in a year. I am not suggesting cyclosporiasis is that illness, and it is not — Brianne lost most of her colon and has been diabetic ever since. The comparison is not about what a case is worth. It is about the distance between what the tort system finds when it looks at one injured person and what a federal cost model finds when it looks at a whole country. Those two systems are not measuring the same thing, and only one of them is used to decide whether a $4.5 million testing program is worth restoring.

We do have a measured figure for the last comparable event. Spalding and Sexton, in the American Journal of Agricultural Economics, put the total societal loss from the November 2018 romaine outbreak at $276 to $343 million. Their own conclusion is the argument I am making: the episode demonstrates the economic benefit of adopting mandatory food-safety standards and improved traceability. For 2006 spinach, USDA’s retail scanner work found $60.6 million in lost consumer grocery spending on all fresh leafy greens over the following fifteen months, and packaged spinach sales were still off about twenty percent a year later.

When the agency proposed pushing the FSMA 204 compliance date from January 2026 to July 2028, it had to run a regulatory impact analysis. That analysis is in the Federal Register, and its arithmetic is not ambiguous. The benefits of the delay are up to a negative $322 million a year. Those are the public health benefits the country gives up by waiting. The cost savings on the other side — what industry keeps by not having to comply yet run about $73 million. This is not my number, and it is not an advocacy group’s number. It is the agency’s own table, in the Federal Register, under the heading Summary of Benefits, Costs, and Distributional Effects.

The second detail is the signature. The proposed rule is signed Robert F. Kennedy, Jr., Secretary, Department of Health and Human Services. Eleven months later the same Secretary told reporters that this outbreak was under control, at a moment when the count was 1,644 in five states. It is now 21,452 across fifty. I do not say he caused it. I say the traceability rule that would have shortened the traceback carries his signature on the paper that delayed it, and that the paper itself says the delay loses money.

On one side: a memorandum, a reporting requirement, some state code, $4.5 million a year, and a rule that is already law. On the other side: a parasite the government prices at $5.3 million a year that has already produced $9.97 million of counted illness by the government’s own per-case figure and plausibly $259 million once you adjust for the cases nobody counted; a comparable produce outbreak measured at $276 to $343 million; a fast-food chain down two percent and its stock down as much as eight; two salad chains with no link to anything down ten and twelve percent; and a delay the agency itself scored as a net loss of nearly forty million dollars a year.

Food safety is not expensive. Outbreaks are expensive. We have spent this summer proving it again, at the expense of twenty-one thousand four hundred fifty-two people who did not get a vote, and at the expense of a great many businesses that did nothing wrong except sell lettuce.

I published a fifty-state count of 20,927 this morning when about to fly home after spending the week at IAFP in NOLA. It is now 21,452 – so much for “Under Control.”

Three states have moved since, and a fourth row in that table was wrong. Michigan added 387 people in a single day and now reports 10,773 cases, with hospitalizations holding at 193 because the state refreshes that figure only on Thursdays. West Virginia posted its Friday update and went from 245 to 268, still with 19 hospitalized. New York moved from 666 to 753, and that number now comes from the state health department itself rather than a secondhand roundup. The new fifty-state total is 21,452.

The fourth change is a correction I owe the reader. My table carried Alabama as publishing no count at all. Alabama has been publishing one since at least July 15. The Alabama Department of Public Health reported 28 cases as of July 20, two of them hospitalized, none fatal, with four tied to international travel and eight tied to two separate foodborne outbreaks at Mexican-style restaurants that the department says plainly are not Taco Bell. That last detail matters more than the twenty-eight does. Alabama does not connect those restaurant clusters to Taylor Farms and neither do I. What it does is put a second state alongside New Hampshire where a health department has named an eating establishment that has nothing to do with a Taco Bell, and it sits with North Carolina pointing at parsley and cilantro and with the six separate Cyclospora investigations FDA still has open on its own table. One recall does not explain over twenty-one thousand people, and I have never said it did.

The correction moves two of my own running lines. The number of states publishing no count of their own drops from fourteen to thirteen. And the group I have been describing for two weeks as states that received the recalled lettuce while publishing nothing about their own residents is down to two. It was Alabama, Mississippi, Missouri and South Carolina. Missouri fell out on Thursday at 593. Alabama falls out now. Mississippi and South Carolina are what is left.

One more thing surfaced in the sweep, and it is another argument for reading every number in the table below as a floor. Three states now publish two different totals, and I have been taking the smaller one every time. New York reports 753 since May 1 and 787 for the calendar year. North Carolina reports 718 since May 1 in its press release and 728 for the year on its own dashboard. Florida reports 254 since May 1 and 264 since January 1. 

Ohio held at 4,013 statewide today, and the county problem inside it got cleaner rather than smaller. Both figures are now dated July 31. The state puts Lucas County at 554. The Toledo-Lucas County Health Department puts Lucas County at 1,207, with 3,016 across northwest Ohio. 

Against all of that, the federal picture has not moved at all. CDC’s outbreak page still says 1,947 people and 98 hospitalizations across nine states, where it has sat since July 24. Its surveillance page still carries 6,707 laboratory-confirmed cases plus more than 11,500 awaiting confirmation across 45 states, published Tuesday and covering reports through July 27. Add those two federal figures together and Atlanta is describing 18,207 people. The fifty states describe 21,452. The two are 3,245 apart, close to eighteen percent, with the states higher. The named outbreak is now 9.08 percent of the illness this country is reporting.

Where each state stands tonight, with the source for every number.

Thirteen states in that table publish no count of their own. CDC says 45 states have cases, which means there are at least nine states where the federal government knows there are confirmed illnesses and a resident cannot look up how many. Thirteen more of these numbers trace to a single national roundup that has not been updated since July 17. Every figure above is a floor, and Alabama is tonight’s proof that a blank cell has never meant no illness. It has only ever meant that I had not found the answer yet.