Daniel Engber’s piece in The Atlantic this morning, The Truth About American Food Safety, closes with the thought that our summer of contamination could have been much worse. He is right, and the reason is not the system. It is the bug. Cyclospora cayetanensis is a parasite that sends about one confirmed patient in twenty to the hospital and almost never kills anyone. Run this summer’s case count through E. coli O157:H7, Salmonella, or Listeria monocytogenes, on the same lettuce and through the same supply chain, and you are no longer counting weeks of diarrhea. You are counting hospital beds, dialysis chairs, and funerals.

Start with the numbers as they stand. CDC’s case data page, updated September 1, reports 18,445 laboratory-confirmed cases of cyclosporiasis acquired in the United States since May 1, with 990 hospitalizations and 2 deaths, in 49 states and the District of Columbia. Thousands more are still being sorted or confirmed. CDC’s outbreak page ties 11,458 of those illnesses, in 20 states, along with 495 hospitalizations and both deaths, to iceberg lettuce from Taylor Farms de Mexico. This summer’s hospitalization rate is 5.4 percent of confirmed cases. That is what Cyclospora does. FoodNet, CDC’s active surveillance network, put the Cyclosporahospitalization rate at 6 percent for 2016 through 2018 and the death rate at 0.2 percent. For scale, FoodNet’s hospitalization rates run 27 percent for Salmonella, 40 percent for E. coli O157:H7, and 96 percent for Listeria.

Salmonella: about 5,000 hospitalizations and 75 to 130 deaths

The same FoodNet report puts Salmonella at 27 percent hospitalized and 0.4 percent dead for 2016 through 2018, and at 30 percent and 0.7 percent in 2023. Apply those rates to 18,445 confirmed cases and you get 5,000 to 5,600 hospitalizations and 75 to 130 deaths. That is not a stretch for produce. The 2023 cantaloupe outbreak, Salmonella on melons imported from Mexico, reached 407 confirmed cases, 158 hospitalizations, and 6 deaths; 44 percent of the people with information available were hospitalized. In CDC’s summary of the multistate outbreaks it solved in 2023, 35 percent of the people in Salmonella outbreaks went to the hospital.

E. coli O157:H7: roughly 7,400 hospitalizations and more than a thousand cases of kidney failure

FoodNet counted 276 domestically acquired O157 infections in its catchment area in 2023. Of those, 111, or 40 percent, were hospitalized, and three died. Forty percent of 18,445 is roughly 7,400 hospitalizations. Deaths run from about 75 at FoodNet’s average for all Shiga toxin-producing E. coli to about 200 at the 2023 O157 rate. Then there is hemolytic uremic syndrome, the kidney failure that O157 causes, mostly in children. In the 2018 Yuma romaine outbreak, 210 confirmed cases produced 96 hospitalizations, 27 cases of HUS, and 5 deaths. In the 2006 spinach outbreak, 205 confirmed cases produced 103 hospitalizations, 31 cases of HUS, and 3 deaths. Earlier O157 outbreaks ran about 6 percent HUS; Yuma ran nearly 13. Apply that range to this summer’s count and somewhere between 1,100 and 2,400 people, most of them children, are in kidney failure. I spent the first decade of my career on E. coli O157:H7 in hamburger, from Jack in the Box in 1993 to the ConAgra recall in 2002. I know what a few hundred cases look like from inside a pediatric intensive care unit. I do not want to learn what 18,000 look like.

Listeria does not need the case count

FoodNet puts Listeria at 96 to 97 percent hospitalized and 19 to 22 percent dead. In 2011, cantaloupe from one Colorado farm produced 147 confirmed cases; 143 of the 145 people with information available were hospitalized, 33 died, and one pregnant woman miscarried. I represented the families of all 33. Take one percent of this summer’s confirmed count, about 180 people, and at the 2011 ratios you have about 40 dead. Nobody has ever seen a listeriosis outbreak of 11,000 people, and I hope nobody ever does, because at FoodNet’s death rate the toll would be more than two thousand.

It could absolutely have happened

Cyclospora is a human parasite. It reaches a lettuce field one way: human waste, usually carried by water. On August 20, FDA said its inspections and sampling had moved from the Taylor Farms de Mexico processing plant to the iceberg lettuce growers in Mexico. A field that takes in untreated water does not have a parasite problem. It has a water problem, and water does not sort its pathogens. In 2018, CDC found the Yuma outbreak strain of E. coli O157:H7 in irrigation canal water in the growing region. Product from Taylor Farms has been linked to E. coli O157:H7 three times since 2015, in celery, slivered onions, and romaine, a record I laid out in July. Lettuce and spinach carried O157 across the country in 2006, twice in 2018, and again in 2019. The distribution system that put this lettuce into restaurants and stores in at least 31 states moves whatever is on the lettuce, and it moves it fast.

The lag does not care what the bug is

The first illness in this outbreak began June 14. The recall came July 17. CDC says it takes about six weeks to determine whether a sick person is part of a Cyclospora outbreak. With a pathogen that hospitalizes one patient in twenty, a five-week gap between first onset and recall costs weeks of diarrhea. With one that hospitalizes two in five and puts children on dialysis, every week of that gap is measured in kidneys. Engber reports research projects lost, a CDC genetics team hollowed out, and experienced staff gone; HHS told him no FDA investigators were lost. Barb Kowalcyk, who directs George Washington University’s Institute for Food Safety and Nutrition Security and who is a friend and one of the brightest people in this field, squares the two better than I can: the system went into this summer underfunded and years behind on changes it knew it needed, and the loss of experienced people since then tied its other hand behind its back. She told Engber that Jack in the Box changed USDA in 1993 and that this summer will drive the next shift; I would add that the 2006 spinach outbreak drove FSMA. I hope she is right, and I hope it happens before the arithmetic above stops being hypothetical. What is not in dispute is that the traceability rule that would let FDA follow a case of lettuce back to the field in days rather than weeks, finalized in 2022 and due this past January, has been pushed to July 2028 by FDA and by Congress. That delay applies to E. coli and Salmonella exactly as it applies to a parasite.

Engber offers his last line as both a solace and a warning. I will take the warning. We got the gentle bug this year. Nothing about how it reached the field, how it moved through the country, or how long it took to find it guarantees we get the gentle bug next time. Luck is not a food safety system.