On July 13, 2026, the FDA sent a letter to the infant formula industry and its supply chain partners. It was the agency’s third letter to that industry naming Clostridium botulinum since March 2023. Between the first letter and the third, 48 infants in 17 states were hospitalized after drinking ByHeart Whole Nutrition Infant Formula, and four more, in California, Pennsylvania and Washington, were hospitalized after drinking Nara Organics Whole Milk Organic Powdered Infant Formula. As of today, August 20, 2026, the federal rule that says what powdered formula must be tested for before it ships names two organisms, and neither of them is the one that paralyzed those babies.

I went back to that letter five weeks after it was issued because Kevin Famuyiro walked through it in the Los Angeles Times. Agency letters land, get a day of coverage, and disappear. Somebody staying on the story after the cycle moves on is how the rest of us get a second look at it, and this one earned one.

Three letters in three years, and fifty-two hospitalized babies between the first and the third.

The first letter went out on March 8, 2023, addressed to every manufacturer, packer, distributor, importer and retailer of powdered infant formula in the country and signed by the Commissioner of Food and Drugs and the Director of the Center for Food Safety and Applied Nutrition. It named Clostridium botulinum by genus and species. It told the industry the agency had already investigated infant botulism among babies who drank powdered formula from a variety of manufacturers. And it told the industry that an ingredient which gets no lethal treatment at the formula plant is an extension of the formula plant, so the hazard has to be controlled at the supplier. I have written about that letter before, because it ends the argument about foreseeability.

The second went out on December 15, 2025, three days after the agency had to send warning letters to Target, Walmart, Kroger and Albertsons for leaving recalled ByHeart formula on shelves — in one case with promotional signage over it more than two weeks after the recall began. That letter reminded the industry of its legal obligations during a recall.

The third is the July letter. Same subject. Same audience. Fifty-two babies further along.

The July letter asks the industry to do what the regulations already required.

Read it with a lawyer’s eye and what stands out is the verbs. FDA “expects manufacturers to exercise substantive oversight of their suppliers.” It recommends that companies stay abreast of recalls, outbreak investigations and import alerts. It calls for increased vigilance. It says the agency is prepared to work with industry to identify best practices.

Now look at what it cites. 21 C.F.R. Part 106, for production and in-process controls from receipt of raw materials through distribution — on the books since long before any of these children were born. 21 C.F.R. Part 117, Subpart G, for hazard analysis, supplier approval and supplier verification — FSMA, 2015. Section 424(b) of the Food, Drug, and Cosmetic Act, for redundancy risk management plans — FDORA, 2022. Every legal duty in the letter existed before the first ByHeart baby got sick. The letter creates no new requirement, sets no new standard, and imposes no consequence on a company that files it in a drawer. It is signed by Donald A. Prater, the Acting Deputy Commissioner for Food.

FDA went looking in the milk powder and found a botulinum toxin gene on the first pass.

The part of the July release that got the least attention is the part that should have gotten the most. In February 2026, the agency ran an initial surveillance sampling assignment: 48 samples of powdered milk from four suppliers to infant formula manufacturers, twelve samples each. Forty-six were negative by PCR. Two were positive — both organic nonfat milk powder, both from the same firm, their sequences within three substitutions of each other. Whole genome sequencing identified Clostridium sporogenes carrying a gene highly associated with botulinum toxin B1.

I will state the caveats the way FDA states them, because they matter. The agency says this suggests but does not confirm that the organism could produce toxin under some conditions. It confirmed that this particular powder was not used to make infant formula. The sequences matched nothing previously reported, clinical or otherwise. This is not evidence about the root cause of either outbreak, and I am not going to pretend it is.

Here is what it is. On a forty-eight sample first look at the dairy ingredient stream that feeds American infant formula, the government found a spore-former carrying a botulinum toxin gene, twice, at one company. That is a reason to keep sampling, on a much larger assignment, and to publish what comes back. It is also a reason to name the firm. Regulators have gotten comfortable telling the public that a hazard was found at an unnamed facility, and the public has gotten used to accepting it. In the ByHeart investigation, whole genome sequencing tied two samples from one lot of organic whole milk powder at a Dairy Farmers of America plant to a clinical sample and to a finished formula sample. We know that name only because the outbreak forced it into the open. Nara Organics, for its part, still has not publicly named the German manufacturer that actually made the formula it sold to American parents. Parents should not have to wait for an outbreak to learn where their formula’s ingredients come from — and they should not have to wait past one, either.

The test the industry actually runs did not find it, and that is now published.

There is a reason FDA is asking outside bodies to revisit the science, and it is more concrete than the letter lets on. In June 2026, Frontiers in Microbiology published an analysis by IEH Laboratories of unopened containers of the recalled formula and of the base powder before packaging. Read it with the disclosure attached: the work was commissioned by ByHeart, and one of the authors works there.

It matters anyway, because the finding cuts against the whole industry rather than one company. Clostridium botulinumwas in the finished product and in the base powder, and isolates from one finished lot and a base powder were genetically identical. The detections came from samples in which sulfite-reducing clostridia were not detectable at all. That is the indicator organism dairy processors screen for as a stand-in for this family of bacteria — the one ICMSF has recommended. The authors concluded that indicator screening would not have prevented the outbreak even if it had been running beforehand, and that C. botulinum should be treated as a hazard reasonably likely to occur in these ingredients.

That last phrase is not rhetoric. Under 21 C.F.R. Part 117, a hazard reasonably likely to occur is exactly what triggers a required preventive control. If that is what this organism is, the analysis in every powdered formula plant in the country is already out of date, and no letter is needed to say so.

FDA, for its part, has asked the International Commission on Microbiological Specifications for Foods to reconsider its published position on whether testing for C. botulinum in powdered formula and dairy ingredients is useful. It has supported a Codex request for scientific advice from the Joint FAO/WHO Expert Meeting on Microbiological Risk Assessment covering C. botulinum and Bacillus cereus. It has engaged Cornell’s Pathogenic Spore Consortium on controlling spore-formers in milk. Those are the right questions. They are being asked after fifty-two children were hospitalized, and they are being asked of bodies that issue advice rather than rules.

Section 106.55 still lists Salmonella and Cronobacter, and that is all.

21 C.F.R. § 106.55 requires a manufacturer to test each production aggregate of powdered formula before it is distributed, and deems the product adulterated if it exceeds the limit. The table names Salmonella and Cronobacter, both at zero tolerance. There is no entry for Clostridium botulinum. There is no entry for Bacillus cereus, which is what produced the cereulide that sickened nearly 150 babies across ten countries this past winter through contaminated ARA oil.

Meanwhile § 106.55(b) sends liquid formula to 21 C.F.R. Part 113, the low-acid canned food regulations — an entire federal regime built around keeping botulism out of a sealed can. Same disease, same babies. A can of liquid gets the full apparatus of American food safety law. A tub of powder gets a letter. I laid that hole out in detail in an open letter to the man who now runs the agency, and it is still there.

A letter is what an agency writes when it is not prepared to write a rule.

Letters are fast. No notice and comment, no interagency review, no cost-benefit analysis, no litigation risk. They are also unenforceable. A company that ignores the July 13 letter has broken nothing.

None of this is aimed at the people who did the work. California’s Infant Botulism Treatment and Prevention Program caught the ByHeart signal by noticing a rise in BabyBIG requests, which is exactly the kind of catch a surveillance system exists to make. The traceback that ran the sequence from a sick infant back to a lot of milk powder at a dryer was careful, difficult work. The failure is not down at that level. It is that after all of it, the agency’s considered response was to write to industry about a hazard it has now named in writing three times, without putting that hazard in the rule.

If any of this reads as abstract from College Park, I would offer what I have been offering for thirty years, and what I wrote out in full last week: spend an hour with one of these families. It changes what the word “vigilance” sounds like.

Congress can close the gap in a sentence — add the spore-formers to the table at § 106.55 and require the dairy ingredients to be sampled upstream, where the spores actually live, instead of only in the last can on the line. That is H.R. 7867, the Infant Formula Safety Modernization Act of 2026. The House returns on August 31 and the Senate on September 14, and in September the 535 t-shirts sitting in my office go out, one to every member, to make the same argument in six words.

Three letters. Fifty-two babies. No rule. The next one FDA writes should not be a letter.