Taylor Farms de Mexico is voluntarily removing all iceberg lettuce sourced from central Mexico from the U.S. market — the company’s own words, posted at 12:44 p.m. Pacific on July 17. The recall lands in the middle of a Cyclospora outbreak that has sickened people across at least five states and, by the states’ own tallies, thousands more than the federal count will admit. Taylor Farms says the FDA traceback points to a single independent farm growing less than one percent of the country’s iceberg, and it is careful to tell you that none of its branded salads or kits are involved and that none of those kits contain iceberg at all. Fine. The lettuce still went somewhere, and where it went, people got sick.

Taylor Farms is privately held — family-owned, as its statement reminds you in the very first breath — which means it files nothing with the Securities and Exchange Commission, owes no risk disclosure to any shareholder, and gets to decide for itself what the public learns and when. The company closest to the contaminated lettuce lives almost entirely outside the reach of the disclosure rules built to keep investors, and by extension the rest of us, informed.

Taco Bell’s parent, Yum! Brands is the opposite. It trades on the New York Stock Exchange, and that means it has to tell its investors what could go wrong. As Forbes reporter Mary Roeloffs documented this week, Yum did exactly that. In its most recent annual report to the SEC, the company listed food- and beverage-borne illness — naming E. coli, Listeria, Salmonella, Cyclospora, and Trichinosis outright — as a leading business risk and conceded that such outbreaks have occurred and may occur within its system. It even flagged that its growing reliance on third-party suppliers and distributors pushes that contamination risk beyond its own control. Translation: Yum told Wall Street, in writing and well before this outbreak, that lettuce it does not grow could poison the customers it serves.

The public company that bought the lettuce warned the world on paper that this exact thing could happen. The private company that grew and shipped it warned no one — and now gets to shape the story on its own terms. That is not a knock-on securities law. It is a knock on a food system where the grower sitting closest to the contamination is the one least accountable to the people eating it. The families counting days in a bathroom right now did not read a 10-K. They ate a salad.

I have been chasing Cyclospora and its cousins since 1993, and the pattern never changes: the sick get counted last, if they get counted at all, and the paperwork that might have warned them sits exactly where no one eating lunch will ever think to look.