The Secretary of Health and Human Services said today that this outbreak is “under control.” I would like that to be true. Here is what the states reported while he was saying it.

Michigan added 2,408 new cases in the week ending July 18. The three weeks before that were 71, then 498, then 1,331. That is not a curve bending down. That is a curve that has doubled in each of the last three weeks, and Michigan’s own total went from 6,148 on Monday to 6,571 today, with 23 more out-of-state cases waiting to be referred somewhere else. West Virginia went from 69 cases on July 13 to 195 today, with 15 hospitalized — nearly triple in eight days. CNN put it plainly this afternoon: the epidemiological curve has not yet slowed.

An outbreak is under control when new cases stop appearing. Not when a recall is issued. A recall is an action taken; control is a result observed. The Secretary described the first and called it the second.

There is a second problem with today’s statement. He said the source has been identified, citing extensive forensics. But FDA spent Sunday night withdrawing the only positive lettuce sample it had as a false positive. The traceback still points at Taylor Farms de Mexico, and FDA is right about that. But there is a difference between an epidemiological conclusion and a confirmed source, and the government is now claiming the second while holding the first. That is exactly the kind of overstatement that gets thrown back at investigators later.

He also said the criticism about surveillance cuts is invalid, and that FoodNet reductions were only for redundant surveillance. CDC made Cyclospora reporting optional in 2025. Six of the eight pathogens came off mandatory reporting. Whether you call that redundant depends on whether you ever intended to count this parasite. We are now two and a half months into a season in which nobody can say how many people are sick, and the Secretary’s own department publishes three different numbers.

Those numbers are worth laying out, because they are the heart of it. CDC’s outbreak investigation page says 1,644 people who reported eating at Taco Bell have been reported by five states, with 94 hospitalizations and illness onsets running from May 13 through July 13. CDC’s health advisory separately says 1,645 lab-confirmed domestically acquired cases across 34 states, with 141 hospitalizations. And CDC’s surveillance page says it is aware of more than 5,100 additional cases awaiting analysis, plus another 440 travel-associated cases. Meanwhile FDA’s outbreak table carries the iceberg lettuce cluster at 1,644 and four other open Cyclospora investigations alongside it.

Add up what the fifty states themselves are reporting and you get roughly 10,750. CDC concedes the point in its own words: it is aware that states are likely to report higher counts than its data reflects. The federal number is not wrong. It is just months behind, and it is the number the Secretary used to tell the country this is handled.

One more thing, and it is not a small one. Ohio’s health department reports 1,316 cases statewide as of July 16. The Toledo-Lucas County dashboard, covering only the northwest corner of that state, reports 2,029. A region inside Ohio is reporting more cases than Ohio. Both numbers are real; they come from different reporting systems that count different things on different days. That is the condition of American foodborne disease surveillance in the middle of the largest cyclosporiasis outbreak this country has ever had. Under control is not the phrase I would use.

Below is where all fifty states stand tonight, with the source for every number.

A word on the counts. Where a state publishes its own figure, I used it, because state health departments are closer to the illnesses and update more often. Where CDC’s own state table differs materially, I noted both — and it cuts in both directions. CDC lists more cases than the state does in New York, Colorado, California, Georgia and Virginia, and far fewer in Illinois. Nobody’s numbers agree with anybody’s.

Update cadence matters too, and it is uneven. Michigan and Indiana post daily on weekdays. West Virginia updates Tuesdays and Fridays. Ohio and Kentucky update weekly. CDC’s national figures have not moved since July 13. So any national total, including mine, is a blend of numbers of different ages. Sixteen states still publish no 2026 count at all.

Roughly 10,750 is a floor, not a ceiling. It mixes domestic and travel-associated illness in the states that do not separate them, it counts only people sick enough to see a doctor who ordered the specific test that finds this parasite, and it omits sixteen states entirely. CDC says the true number is likely higher. On that, the Secretary and I and CDC all agree.