Two questions crossed against each other for all fifty states: did the state receive iceberg lettuce that Taylor Farms de Mexico recalled on July 17, and does the state publish a 2026 Cyclospora count of its own.

CDC published its weekly surveillance update on Tuesday, July 28, and it finally answered the two questions this map had been unable to answer for a week. How many states, and how many hospitalizations. The answers are 45 statesand 423 hospitalizations, against 6,707 laboratory-confirmed domestic cases for the period May 1 through July 27. The agency updates that page once a week, on Tuesdays, so those figures stand until August 4.

Hold those next to what the same agency says on a different page. CDC’s outbreak page still reads nine states and at least 98 hospitalizations, and it has read that since July 24. One arm of CDC says 45 states and 423 people were sick enough to be admitted to a hospital, and another arm of CDC says nine and 98. Both numbers are current. Both are correct. They differ by more than a factor of four because they are answering different questions, and only one of those questions was ever about a parasite. The other was about whether you ate at a Taco Bell. CDC says so in its own footnote: the 1,947 counts people who ate at a Taco Bell in one of the nine states, including people who were only traveling through.

The surveillance page carries 6,707 laboratory-confirmed domestic cases, up roughly 2,500 from the July 21 update, plus more than 11,500 more that are not laboratory confirmed or still need international travel ruled out. The state count went from 41 to 45 in that same week. Sick people range in age from 1 to 98. No one has died. The agency estimates a six-week lag between when somebody gets sick and when the case reaches Atlanta, which means every one of these figures describes a June that is already over.

Here is the arithmetic. Add CDC’s own two figures together and the agency is describing 18,207 people, which is how the American Hospital Association reported it. Add up what all fifty states publish about themselves, one state at a time, and the total is 18,687. Those two numbers were built by completely different methods, and they land within about two and a half percent of each other. Two independent counts of this outbreak now agree on roughly eighteen and a half thousand people. The number the government calls the outbreak is 1,947. That is under eleven percent of it.

Five states moved on this table since last night, and every one of them moved up. Kansas nearly doubled in a week — KDHE reported 461 cases on Wednesday, up from 289, with 20 hospitalized, 405 of those cases in July alone, and roughly 190 interviews still pending. West Virginia is at 245 with 19 hospitalized as of July 28, not the 226 this table carried. Illinois is at 532 and Pennsylvania is at 82, per CNN’s tracker as of Wednesday. And Florida jumped to 254 in Thursday’s state report, covering illnesses through July 25, up from 158 a week earlier. Its weekly series since May 1 now runs 50, then 96, then 158, then 254. Pennsylvania is worth pausing on too. Cyclosporiasis is not a reportable condition there — CDC’s own footnote says Pennsylvania cases are reported voluntarily — and it still nearly doubled.

Michigan is unchanged at 10,077 since Wednesday, up 397 in a day, in a state that identifies about fifty cases in an ordinary year. But MDHHS attaches a caveat to its own numbers that deserves to travel with them: the July 27 total included roughly 475 cases that had not previously been reported to the state because of delayed laboratory reporting, and the department says plainly that those do not reflect a sudden increase in illness. Some of this curve is the parasite. Some of it is the laboratory catching up. Anyone quoting a daily jump should say which. Michigan has now completed more than 2,000 interviews and calls the evidence pointing at Taylor Farms shredded iceberg very strong.

In Ohio, the regional number has now passed the state one. The Toledo-Lucas County dashboard reports 2,856 cases across northwest Ohio and 1,183 in Lucas County as of Wednesday. The Ohio Department of Health’s statewide figure is 2,574 and has not moved since July 24. A corner of Ohio is reporting more illness than Ohio.

Which raises the thing I want to flag about this table rather than bury in it. Fourteen of the fifty numbers below trace to a single national roundup, and that roundup has not been updated since July 17. Its Michigan entry still says 4,312. Its Ohio entry still says 177. Those two states have since gone to 10,077 and past 2,500. There is no reason to think Arizona, Colorado, Georgia, Iowa, Louisiana, Maryland, Massachusetts, Minnesota, Nebraska, Rhode Island, Tennessee, Utah and Wisconsin are frozen in real life; they are frozen in the only public record I can find. Nebraska is the clearest example: it sits here at 49 from July 17, and on Wednesday the Lincoln-Lancaster County Health Department alone reported 33 cases in July, 30 of them acquired in this country, and said that is above what it normally sees. One county is most of the state’s published total. Every one of those fourteen numbers is a floor.

The nine outbreak states now hold 15,834 of the 18,687. CDC’s outbreak count for those same nine states is 1,947. That leaves 13,887 people who are sick with this parasite, in the nine states the government has already named, who are not in the number the government publishes — because they apparently did not report eating at a Taco Bell. Eighty-seven percent of the illness inside the outbreak states still sits outside the outbreak count.

The other sixteen dark-green states — the ones that received recalled Taylor Farms lettuce but are not among the nine — report 1,816 between them. Seventeen of those 1,816 have a named source (Taylor Farms lettuce), and all seventeen of them are in one hospital cafeteria in Keene, New Hampshire.

One honest limit on the number at the top of this page, before somebody else raises it for me. CDC’s 6,707 counts only people who did not travel internationally. The fifty-state total does not make that cut, because most states do not publish it. Where they do, the share is not trivial: Florida says 28 of the 158 it was carrying a week ago were acquired outside the country, Virginia says 31 of its 126, Illinois said 96 of 216 in mid-July, and Kansas reported 17 of 55 the same week. The eleven light-green states are the most exposed to this, because they are light green precisely for the reason that the recalled lettuce never reached them, and New York is 666 of their 1,037. That makes 18,687 a count of reported cyclosporiasis, not a count of domestically acquired cyclosporiasis, and I am not going to pretend otherwise.

It cuts the other way too, and harder. CDC estimates a six-week lag between illness and report. Cyclosporiasis is missed unless a clinician specifically orders the test for it, which is why CDC calls it underdiagnosed and underreported in its own health advisory. And none of these numbers include the people who got sick, stayed home, and got better. The comparison that survives all of it is the one inside the nine outbreak states, where state-reported illness is measured against state-reported illness: 15,834 against 1,947. Nothing about travel, lag or testing explains a gap that size, because both halves of it were counted the same way.

There is one more thing in the July 28 update worth sitting with. CDC now says 45 states have cases. Only 36 states publish a count of their own. That leaves at least nine states where the federal government knows there are confirmed cases and the residents of those states cannot look up how many. On the map below they are hatched, and hatching has never meant no illness. It has only ever meant no answer.

And we can now name some of them. The four states CDC added going from 41 to 45 were Oregon, South Dakota, Vermont and Delaware. Three of those four are hatched on the map below, which is to say the federal government has confirmed cases in South Dakota, Vermont and Delaware and none of those three health departments publishes a number. A resident of Dover who wants to know how much of this is in Delaware has to read a CDC surveillance page to find out that the answer is not zero, and still cannot find out what it is.

Every case number below, the color it produced, and a link to where it came from. Where a state publishes on a fixed schedule, that schedule is noted, because a number is only as fresh as the day its agency next opens the file.

A dark-green state is not a state where the lettuce is proven to have sickened anybody, and a light-green state is not a state where it is proven not to have. The map shows where product went and where illness was counted. What it keeps showing, six redraws in, is that the government’s outbreak number is not tracking the outbreak. It is tracking the questionnaire. CDC moved its own state count from 41 to 45 this week and its hospitalization count from something it would not publish to 423. Four more states moved yesterday. The outbreak page has not moved since July 24. Nor is the nine-state cluster the only thing open: on July 29 FDA raised a separate Cyclospora investigation with no identified source from 72 cases to 93.