Chipotle Mexican Grill confirmed today that it traced ingredients through its supply chain after learning of a potential Salmonella outbreak, identified jalapeños from a common lot as a possible source, pulled them from every restaurant that received the product, and replaced them with peppers from different growers. Shares fell 7 percent on the afternoon. The illnesses surfaced first in Minnesota, where Bloomberg reported 110 people sick. Of 84 who have been interviewed, 75 said they ate at a Chipotle. A Minnesota Department of Health spokesperson says the full scope is not known that other states are involved, and that some of the sick ate at other restaurants entirely.

Read that last part again, because it is the whole case. If people are getting sick at restaurants that are possibly not Chipotle, then this is not only a Chipotle problem. It is a pepper problem, and the peppers went somewhere besides Chipotle.

Which brings me to the U.S. Food and Drug Administration. Its CORE outbreak investigation table was last updated July 29 and still carries two unsolved Salmonella investigations with no product named. Ref #1395, Salmonella Javiana, jumped from 106 cases to 212 with sampling initiated. Ref #1387, Salmonella Oranienburg, sits at 90. Both are logged as “not yet identified.” I wrote about the Javiana investigation yesterday — 212 sick, twenty-five years of outbreak history pointing straight at produce, and still no product named. Today a state health department and a restaurant company did in public what the federal table has not done in six days. A sick person looking to the FDA this morning for a reason to throw something out of the refrigerator got nothing.

Jalapeños have a record, and it is not a good one. In 2008, Salmonella Saintpaul sickened 1,442 people across 43 states, the District of Columbia and Canada, hospitalized at least 286, and may have contributed to two deaths. Investigators chased raw tomatoes for months and destroyed the domestic tomato market doing it. The New England Journal of Medicine account of the investigation is the definitive one: eating at a Mexican-style restaurant, eating pico de gallo, and having a raw jalapeño in the house all tracked with illness, jalapeño peppers were implicated in every restaurant cluster with an identified ingredient, and the outbreak strain turned up in a jalapeño in Texas and in irrigation water and a serrano pepper on a Mexican farm. Tomato traceback never converged on anything. Peppers get eaten raw, they get diced into salsa by the pound, and they are grown and irrigated in places where the water has never been the subject of a serious inspection.

Now the Chipotle record, because it matters what a company already knows.

In July 2015, five patrons of the Chipotle at 1415 Broadway in Seattle became ill with E. coli O157:H7 with onsets between July 28 and 31. Three were hospitalized. It was never announced publicly — I wrote about that silence at the time.

In August 2015, roughly 80 customers and 18 employees fell ill with norovirus at the Simi Valley, California store after a sick employee was kept on the schedule. The Justice Department later put the figure at 234.

From August into September 2015, Minnesota logged 64 cases of Salmonella Newport across 22 Chipotle locations, with nine hospitalized and meal dates from August 16 to 28. MDH and the Minnesota Department of Agriculture identified tomatoes as the source and traced them toward the farm. A produce ingredient, in Minnesota, found by the same state lab that is running today’s investigation.

From October into December 2015, two genetically unrelated E. coli O26 outbreaks ran through the chain. The CDC’s final update counted 55 cases in 11 states with 21 hospitalized in the first, and five cases in three states in the second. No food or ingredient was ever identified in either one.

In December 2015, 141 people were sickened by norovirus at the Cleveland Circle store in Boston. Prosecutors later said it began when an apprentice manager told a regional manager he had vomited on the job and was ordered to keep working. It was not reported to company food safety officials. He took a sick day, came back, and helped package a catering order for the Boston College basketball team. Players got sick.

In July 2017, more than 135 people were sickened by norovirus at the Sterling, Virginia store. In July 2018, 647 people fell ill with Clostridium perfringens after eating at the Powell, Ohio store between July 26 and 30. The store closed on the 30th and reopened on the 31st.

Then came the bill. On April 21, 2020, the Department of Justice charged Chipotle with two counts of violating the Federal Food, Drug, and Cosmetic Act by adulterating food held for sale after shipment in interstate commerce — a strict liability misdemeanor that requires no proof of intent, only that adulterated food was served. The criminal information was filed in federal court in Los Angeles and covered five incidents in Los Angeles, Simi Valley, Boston, Sterling and Powell, more than 1,100 people sickened between 2015 and 2018. The company admitted its practices — food held out of temperature; sick employees kept on the line — made people ill. It paid a $25 million criminal fine, the largest ever imposed in a food safety case, and entered a three-year deferred prosecution agreement requiring a comprehensive food safety compliance program built with its Food Safety Council and covering audits, restaurant staffing and employee training. FDA’s Office of Criminal Investigations ran the investigation. If Chipotle complied for three years, the government would move to dismiss. The E. coli outbreaks were never part of the criminal case, and no individual was ever charged. My post from that day is still up.

That agreement’s three-year term expired in 2023.

One more for the stack, because almost no one knows it happened. In December 2021, a four-case E. coli O121:H19 cluster hit two Chipotle stores in Rochester, Minnesota alongside two Panera locations in Washington. FDA opened a traceback, both legs converged on a single processing facility, and the agency redacted the name. It never issued a public warning and said there was no actionable advice for consumers. The King County environmental assessment, which FDA never linked into the national record, names the company behind the redaction four separate times: Taylor Farms of Salinas.

Four sick people, two states, a converged traceback, and silence.

If jalapeños hold up here, this will be the first produce-vehicle outbreak at Chipotle since the deferred prosecution agreement lapsed, and the second one in Minnesota. It will also be the second time in eleven years that a Minnesota state epidemiologist named the ingredient before the federal government did. That is not a knock-on Minnesota, which runs one of the two or three best foodborne disease units in the country. It is a knock on a system in which whether you find out you were poisoned depends on which state you happened to be standing in when you ate.

The peppers came from a grower. The grower has a name. Somebody knows it today, and the people counting 110 sick in Minnesota — and however many more are sick in states that have not been named yet — deserve to know it too.