The Maricopa County Department of Public Health (MCDPH) has released its final report on last fall’s Shiga toxin-producing E. coli (STEC) outbreak. In the report, the source is called “Event A” – “a public event within Maricopa County with multiple food vendors and petting zoo exhibits” that ran over multiple weekends and ended on Sunday, October 26, 2025. Parents, Food Safety News, the Arizona Republic and the calendar all call it what it was: the Arizona State Fair, which ran in Phoenix from September 19 through October 26, 2025.

The numbers

Eighteen people were part of the outbreak – 16 confirmed by whole genome sequencing (WGS) and two probable cases that were diagnosed by culture-independent tests and linked by their attendance at the fair. The 16 sequenced isolates were within 0-2 SNPs of each other, which, as the county put it, indicates a common source.

The victims were mostly children. The median age was 10, with a range of 2 to 28 years. Eleven (61%) were hospitalized and six (33%) developed hemolytic uremic syndrome (HUS). That is an extraordinarily severe outbreak – the county itself called the outbreak “notable for its severity.” Illness onsets ran from October 28 through November 14, peaking on October 29.

Sixteen of the 18 (89%) reported animal contact. Thirteen (72%) attended the fair on October 26 – its final day – and 11 of those 13 visited the animal areas. One additional case visited a different, unrelated petting zoo that same day. The most frequently reported animal exposures were goats (83%), pigs (67%) and donkeys (42%).

Overall, the county saw 58 STEC cases from September 19 through November 30, compared to a five-year average of 32 for the same period – a statistically significant increase.

Petting zoo: odds ratio of 190

MCDPH ran a case-case analysis comparing outbreak cases to STEC cases from earlier in 2025. Several exposures popped up early – pre-cut apples, turkey eaten outside the home, social gatherings – but those were based on small numbers and wide confidence intervals, and no common food, grocery store, restaurant or geographic cluster was found. Petting zoo exposure, on the other hand, carried an odds ratio of 190.0 (95% CI: 34.6-1092.0). In epidemiology, you do not see numbers like that very often.

The county concluded that animal contact was “the primary driver of this outbreak,” while noting that no single animal was identified and no environmental or laboratory confirmation of a specific animal source was obtained.

Handwashing – or the lack of it

Here is the part of the report that should get the attention of every fair board and petting zoo operator in the country. Of the 11 sick people who visited the animal areas at the fair, only five (45%) recalled handwashing stations being available. Eight (73%) recalled hand sanitizer. Eight (73%) reported washing their hands after animal contact.

That tracks with reporting by the Arizona Republic that State Fair officials later confirmed the petting zoo exhibit did not have handwashing stations with soap and running water attached nearby. Hand sanitizer is not a substitute for soap and running water – especially on the hands of a small child who has just been rubbing a goat or a pig.

The county’s own recommendations are hardly new: handwashing stations that are available and visible, clear signage, and separating animal contact areas from places where people eat and drink. These measures have been recommended for petting zoos for decades. They were not adequately in place at one of the largest public events in Arizona.

Great American – and Fresno, 20 years ago

The county report does not name the petting zoo operator. The Arizona Republic has: for the past 15 years, the State Fair’s petting zoo was run by Great American Entertainment of Stephenville, Texas.

That name should sound familiar. In October 2005, at least six children who visited the petting zoo at the Big Fresno Fair were sickened with the same strain of E. coli O157:H7. That petting zoo was operated by Great American Petting Zoo. One of those children, a two-year-old girl, developed HUS, suffered kidney failure and several strokes, and was left with lasting health problems. The Big Fresno Fair paid $2.2 million to settle her case, and agreed to put handwashing stations outside the petting zoo.

And what was available at the Fresno petting zoo in 2005? Alcohol hand sanitizer stations. Twenty years later, the same operator, a different fair, sick children, HUS – and, again, hand sanitizer rather than soap and running water. Lessons that are paid for in children’s kidneys should not have to be learned twice.

“No intervention at Event A was possible”

The county notes that because most cases were exposed on the fair’s last day, there was no opportunity to intervene at the fair itself. That is true as far as it goes. But a children’s hospital alerted MCDPH on November 3 – with nine pediatric cases over a single weekend and five families already naming the fair – and the state did not issue a health alert to providers until November 12. As the Republic has reported, state and county health officials withheld from the public the details of the source and size of the outbreak while the case count was rising. Parents of children who were at the fair and had a stomach ache deserved to know what to watch for. HUS does not wait for a press release.

What comes next

Some lessons have been learned. The Arizona State Fair has dropped its petting zoo for 2026, and the Maricopa County Fair dropped direct public animal contact and pony rides. But Arizona Senate Bill 1082, which would have required commercial petting zoos to control access to animals, ensure patrons wash their hands and post warning signage, died. Voluntary decisions by a couple of fairs are not a standard.

MCDPH says it will work with state and local partners to develop guidance for petting zoos and similar venues. Guidance is good. Requirements – with soap, water and someone checking – are better. Six people, most of them children, developed HUS because a fun day at the fair ended in a hospital bed.

As I noted last fall, Marler Clark was retained to investigate the illnesses linked to the Arizona State Fair petting zoo. The county’s report confirms what those families told us from the start.

Report – https://www.marlerblog.com/files/2026/10/STEC-OCT-NOV-2025-Final-Report.pdf

Deschutes County Health Services has told doctors in Bend and the rest of Central Oregon that it is investigating, with the Oregon Health Authority, a multistate outbreak of Salmonella Enteritidis infections. The Health Alert Network advisory, which Food Safety News reported on October 12, 2026, names no source, no case count, no other state and no onset dates. As of this morning no federal page acknowledges that the outbreak exists. I wrote up the advisory itself on Food Poison Journal over the weekend. This post is about the gap between what the doctors were told and what the rest of us were told.

The advisory tells clinicians what to ask and tells the public nothing.

The advisory asks providers in Deschutes, Crook and Jefferson Counties to watch for diarrhea, fever and cramps consistent with salmonellosis, and to take a five-day exposure history that covers eggs and egg-containing foods including fresh or locally sourced eggs, raw unpasteurized milk, contact with chickens, baby chicks, lizards, snakes and turtles, and specific restaurant names, locations and meal dates. It asks that any positive PCR be followed by a reflex culture so the state lab can sequence the isolate, because without an isolate there is no whole genome sequencing and without sequencing there is no way to link an Oregon case to one in another state.

That is a competent advisory. Every item on it is also something a member of the public could act on this week: cook eggs through, skip the raw milk, wash hands after handling chicks, and hold onto receipts. The exposure list reads as the standard Enteritidis list, and the request for restaurant names and meal dates says the investigators are still looking at restaurants. None of that reached the public through any Oregon or federal channel. It reached the public because a trade publication found the PDF.

No federal page acknowledges the outbreak.

CDC has posted nothing. When I opened CDC’s active investigations dashboard this morning it counted fifteen active multistate Salmonella investigations, and the only open Salmonella outbreak notices on CDC’s site are the Evergreen broccoli sprouts outbreak and the pet turtles outbreak, plus the alfalfa sprouts notice that carries both E. coli and Salmonella Agona. The dashboard says, in its own words, that “some of the investigations above have CDC Outbreak Notices to let people know actions they can take to stay healthy.” Deschutes County just told its doctors what those actions are.

FDA’s CORE investigation table, still stamped October 7, has no Enteritidis row. The only 2026 Enteritidis row it ever carried was the Midwest shell egg outbreak, reference 1378, and that one has been moved to the closed table. If this outbreak is being worked at the federal level, it is being worked somewhere the public cannot see, which for eggs and poultry could mean FDA, FSIS or both.

Three state Salmonella clusters this fall have no serotype and no source in public.

Oregon is not alone. Utah’s Bear River Health Department announced twenty-one confirmed cases in Cache and Box Elder Counties on September 1 and has not updated the count, named a serotype or named a source since; I wrote about it the day it came out. West Virginia’s Monongalia County Health Department said on September 30 that it was investigating a higher-than-normal number of cases; its health officer told the Dominion Post sixteen were lab-confirmed over about two weeks, with a few overnight hospitalizations and no common link, and I covered that too. Neither department has said which Salmonella it is.

JurisdictionFirst public wordConfirmed cases disclosedSerotype disclosedSource disclosedFederal notice
Bear River Health District, UtahSeptember 1, 2026 (media release)21NoNoNone
Monongalia County, West VirginiaSeptember 30, 2026 (release; count to local press)16NoNoNone
Deschutes County, OregonOctober 11–12, 2026 (provider advisory surfaced in press)None givenYes: EnteritidisNoNone

Sources: Bear River Health Department release (Sept. 1, 2026); Monongalia County Health Department release (Sept. 30, 2026) and the Dominion Post (Sept. 30, 2026); Deschutes County Health Services advisory as reported Oct. 11–12, 2026; CDC and FDA pages checked Oct. 12, 2026. Check: the two clusters that gave a number total 21 + 16 = 37 confirmed cases; Oregon gave none, so the public total across the three is at least 37.

I am not saying the three are connected. I have no evidence that they are, and the Bear River department has said its strain did not match the Evergreen sprout strain, which is the only match anyone has publicly ruled out. The point is narrower. Thirty-seven confirmed cases across three counties in two states, and a multistate outbreak in a third state, have been described to the public without a serotype in two of the three and without a source in all three, and the one federal tool built to tell the public about multistate outbreaks has nothing on any of them.

The advisory’s file name says September 3, and the county should say when it was issued.

The advisory sits on the county’s document server under the file name “Advisory—Salmonella-Outbreak-09032026.” The server blocks automated readers, so I have not been able to confirm the date on the face of the document, and neither Food Safety News nor my own weekend post could date it. If that string is the issue date, Central Oregon’s clinicians have known about a multistate Enteritidis outbreak for five and a half weeks. If it is not, the county can say so in a sentence. Either way the first question for Deschutes County and the Oregon Health Authority this morning is the simplest one: when did you know, and when did you plan to tell the people who eat the eggs?

This is the gap the two petitions I filed last week are meant to close.

On October 8 I sent FDA two citizen petitions after thirty-eight people got sick from chicken wraps that no agency would name. The first asks FDA to publish the suspect food, the states, and the illness and hospitalization counts while an investigation is open, and to stop treating an implicated firm’s name as confidential. The second asks for store lists on Class I recalls and for a product pulled because of an outbreak to be called a recall whatever the company calls it. Those petitions are addressed to FDA, and the Deschutes outbreak may turn out to belong to FSIS or to CDC’s notice desk instead. The principle does not change with the agency. If an outbreak is serious enough to alert every clinician in three counties, it is serious enough to alert the patients.

Oregon, CDC and the other states can fix this with five facts.

The count, the states, the onset range, whether a food or an animal has been identified, and the date the advisory went out. The serotype is already public, which is more than Utah or West Virginia have given. None of those five facts compromises an investigation; CDC publishes all of them on every outbreak it chooses to post. Last week I wrote that Gallup found only 47 percent of Americans confident in the federal government’s ability to keep food safe, a record low. Outbreaks the public learns about from a PDF meant for doctors are how a number like that is earned. If you are in Central Oregon and have had diarrhea, fever and cramps in the last week, see a doctor, ask for a stool culture and not just a PCR, and tell them about the advisory; CDC’s symptoms page puts onset at six hours to six days after exposure. I will update this post when Oregon or CDC says more.

Saturday, October 10, 2026

Last Saturday’s edition closed on three files shut without a cause and eleven open files carrying 675 sick with no food named. This week FDA matched the broccoli sprout outbreak to a seed lot, three seed brands recalled it from five online marketplaces, and the supplier is still unnamed; the E. coli O157:H7 file FDA shares with USDA got a food and no brand; the no-food ledger fell to 619; and Taylor Farms announced its own remedy six days after FDA announced ten. The through-line of this fourteenth column: the sources are known, the names are not.

FDA matched the Evergreen broccoli sprout outbreak to seed lot W4105 on Wednesday, and by Friday three brands of home-sprouting seed from that lot had been recalled. FDA’s October 7 update links the outbreak to broccoli sprouts and microgreens grown from a contaminated seed lot; FDA’s own seed sample tested positive and whole genome sequencing matched it to the Salmonella Bovismorbificans strain making people sick; the unnamed supplier recalled lot W4105. Counts are unchanged since September 24: 32 sick in six states, three hospitalized, onsets July 7 to September 3, 24 in Washington. EAK Distributionof Casper, Wyoming, pulled its HOME GROWN broccoli seed from Amazon October 2; Eden Brothers of Arden, North Carolina, recalled Calabrese broccoli seed in packets, one-ounce and one-pound sizes October 7, sold July 8 through September 28; Gardeners Basics of Spanish Fork, Utah, recalled one-pound Waltham 29 sprouting seed October 8, sold through Amazon, its website, TikTok Shop, Walmart, eBay and Etsy, and says its supplier told it September 26 that FDA had found Salmonella in the seed, eleven days before the public learned of the match. Food Safety News reported Friday that FDA still will not name the supplier. I covered the second seed recall at Food Poison Journal, and on Monday the firm announced it has been retained by a Washington resident sickened in this outbreak.

The other sprout outbreak sits at 76 sick, and its seed supplier is named in public only by one of its own customers. CDC’s October 1 update: 76 sick in sixteen states, six hospitalized, onsets May 31 to September 7, 64 E. coli, nine Salmonella Agona, three with both; Wisconsin counts 27 sick and three hospitalized as of October 5. FDA’s advisory, also October 1, names seed lot SAL2-24JB, says it went to another sprout grower, and names neither grower nor supplier. Todd’s Seeds, which recalled its own alfalfa seed off that lot, names its source: International Specialty Supply (International Sprout Holdings, Inc.) of Cookeville, Tennessee. LEASA Industries of Miami recalled more than 15,000 cups of alfalfa sprouts grown from seed that may have carried E. coli, initiated September 4, classified October 2, Enforcement Report only, Florida and New Hampshire, no press release and no word on whether LEASA is the second grower. Across both sprout outbreaks 108 people are sick. Comments on my draft sprout warning label petition and the companion raw milk cheese petition run through October 15.

Thirty-eight people are sick in the E. coli O157:H7 file FDA shares with USDA, and the file has a food now and still no brand. FDA’s outbreak table, re-stamped October 7, fills file 1421’s product column with a multi-ingredient wrap with chicken, marked suspect: ready-to-eat, USDA-regulated, removed from the market before the link was confirmed, past shelf life. The agencies are asking whether an ingredient was contaminated, and FDA has started an inspection. The count has been 38 since September 30, from 25 when the file was posted September 23. No CDC notice, no FSIS alert, no store list, no recall; Food Safety Newsreports USDA has posted only a link to FDA’s table. Hospitalizations and HUS are undisclosed. I wrote Thursday on what FDA said and on why a known food with no name falls through both agencies.

Taylor Farms announced its own remedy on Thursday, six days after FDA announced ten. Bruce Taylor’s letter, dated October 8, says the company will indefinitely suspend harvesting and processing central Mexico iceberg for the United States and Canada during the CDC-defined Cyclospora season, expand year-round health monitoring, increase irrigation water and crop testing, invest in detection research, and join what it calls a public-private task force with FDA, scientists, industry and public health officials. No FDA page uses the words task force; the agency’s list is the ten actions of October 2, which I went through on Wednesday. The letter carries neither the count, the dates nor the two environmental positives; my open letter to Mr. TaylorFriday supplies them with a 23-item agenda. Unchanged: FDA’s closed file at 12,883 sick, 570 hospitalized, two dead, 21 states, last onset August 17; CDC’s season count at 19,883 cases and 1,064 hospitalizations as of September 15.

Two more letters landed the same week, from opposite directions. Consumer Reports wrote FDA’s acting deputy commissioner for food, Donald Prater, October 8 those investigators took nearly a month to begin environmental sampling and on-site inspection in Mexico and the recall classification took more than a month, with eight questions due November 6. Western Growers told members October 7 that Mexico’s COFEPRIS acknowledged the two positives October 3 and said they alone do not establish produce as the source, the argument I answered Sunday. The industry meets in Orlando next week at IFPA’s Global Produce and Floral Show, October 13 to 16, with an FSMA 204 session and my twenty-years-after-spinach questions waiting. FDA published notice Friday of a November 6 virtual meeting on lot-level traceability, part of the engagement Congress required when it barred enforcement before July 20, 2028.

The Graziers raw milk cheese file got an on-site inspection this week, a call from the pediatricians to ban the product, and no new numbers. FDA’s advisory, re-stamped October 9 without new text: 13 sick in nine states, eight hospitalized, three with hemolytic uremic syndrome, last onset August 26, more than half five or younger; the outbreak table shows an inspection initiated at an undisclosed location. On October 5 the American Academy of Pediatrics published a policy statement in Pediatrics renewing its call to ban raw milk and raw milk products, cheese included, noting nearly half of raw dairy illnesses are in people under 20. I am asking FDA for less, a warning label and the 60-day aging reevaluation it promised in 2013. Louisiana posted an advisory October 5 with no Louisiana cases.

FDA’s no-food ledger fell from 675 to 619 this week, and nobody got better. The October 7 tablecarries fifteen active files, nine with no food named: Salmonella Newport 116, Salmonella Oranienburg 99, Salmonella I 4,[5],12:i:- 43 with the outbreak ended and an inspection under way, Listeria at 44, 11 and 11, Cyclospora at 235, 38 and 22. The drop: the wraps got a vehicle and a fourth Cyclospora file, 18 sick, closed, along with the frozen blueberry file and the romaine E. coli file, whose Executive Incident Summary Abstract is finally posted. CDC’s dashboard, updated October 7: 31 active multistate investigations, sixteen Salmonella, eight E. coli, six Listeria, one Campylobacter, down from 33. FDA’s October 5 blueberry update says the Chilean grower did not provide all requested records, that the October 2 expansion to Walmart and Trader Joe’s products came from an on-site foreign inspection, and that the firm is on Import Alert 99-35; CDC re-stamped its closed page the same day, as I noted at Food Poison Journal.

Two documents this week showed how often the agencies know the food and do not say so.FDA’s CORE+EP 2025 annual report, covered by Food Safety News October 6, counts 69 incidents, 26 responses and 11 advisories; I counted five outbreaks where FDA knew the food and issued no warning. Phyllis Entis used a FOIA request to pry loose a redacted 2025 CORE report on an eight-case Listeria outbreak and traced it to California peaches and a packer whose peaches were recalled in October 2025; I said thank youThursday. Monongalia County, West Virginia, is still investigating sixteen lab-confirmed Salmonella cases in two weeks with no source, which I wrote up Monday.

Phyllis Entis’s ledger at eFoodAlert went three days without a United States item and then filled in a hurry. October 3 carried the LEASA sprouts and a frozen pizza allergen recall; October 4 through 6 had no U.S. alerts. October 7: Eden Brothers, FSIS’s public health alert on GRACE canned chicken Vienna sausages illegally imported from Jamaica and sold in Alabama, Florida, Georgia, Maryland and Texas, and two FDA warning letters. October 9: Gardeners Basics, and Krasnyi Oktyabr’s Starfish Seafood Trio cold-smoked salmon, halibut and trout from Latvia, recalled for Listeria monocytogenes that New York’s agriculture department found in routine sampling October 1 and FDA posted eight days later. The same state program caught Walker’s Wine Juice of Forestville, New York, selling pumpkin juice with a pH too high for its hot-fill process and no kill step, a botulism risk pulled from its store and wineries in twelve states. Allergens: soy in Saint Francis frozen pizzas, milk in Nature’s Own Hawaiian Bread, sesame in Oliva hummus. No FSIS recall surfaced, only the alert.

Gallup put a number on all of this, and it is a record low. Sixty-five percent of Americans are confident in the safety of grocery-store food, down from 73 percent a year ago and 81 percent in 2019; 47 percent trust federal oversight; 73 percent avoided a brand or food after a recall. I offered ten ways to win it back Thursday, having opened the week with a Publisher’s Platform asking to be put out of the lettuce business before 2027. The Senate will not vote on Heidi Overton’s FDA nomination before November 9. Judge Chhabria’s pause on USDA’s relocation of about 2,600 employees runs through October 13, no ruling yet. Spotlight on America asked how botulism got into infant formula, which H.R. 7867 would start to answer by requiring testing. The two draft petitions on naming implicated firms and publishing consignee lists, dated October 8, ride with Friday’s open letter for comment before filing.

That’s the week — a seed lot matched by genome sequencing and recalled from five marketplaces with no supplier named, 38 people sick from chicken wraps with a food and no brand, a no-food ledger at 619, a lettuce company announcing its remedy before the agency finished its list, and a ban call landing on a cheese outbreak still at thirteen. Check back next Saturday.

About Bill Marler

William “Bill” Marler has spent more than thirty years as a food safety lawyer and advocate—work that began with the 1993 Jack in the Box E. coli outbreak and has never really stopped since. In the years that followed, he has represented victims in nearly every major foodborne illness outbreak in the United States. That case, and the movement it launched, is the subject of the book “Poisoned” and the Emmy Award–winning Netflix documentary of the same name. Bill’s work has been profiled in The New Yorker (“A Bug in the System”), the Seattle Times (“30 years after the deadly E. coli outbreak, a Seattle attorney still fights for food safety”), the Washington Post (“He helped make burgers safer. Now he’s fighting food poisoning again”), and many others.

Dozens of times a year, Bill speaks to industry, regulators, and universities across the United States, Canada, Europe, Africa, China, and Australia about a simple idea: outbreaks are preventable. He has testified before Congress on the Food Safety Modernization Act and teaches food safety at institutions including the Harvard T.H. Chan School of Public Health. He writes regularly about food litigation and food safety at Marler Blog, and in 2009 he founded Food Safety News, which he continues to publish.

Dear Bruce,

I read your October 8 letter. You say Taylor Farms will “indefinitely suspend the harvesting and processing of iceberg lettuce from central Mexico” for sale in the United States and Canada during the Cyclospora season, and that the company will join “a public-private task force that includes the FDA, scientists, industry leaders” and public health officials to find “lasting prevention measures for all fresh produce growers.” Your letter came six days after FDA closed its investigation of the shredded iceberg lettuce outbreak at 12,883 confirmed illnesses, 570 hospitalizations and two deaths in 21 states, with the last illness beginning August 17.

I have spent a good part of this summer and fall criticizing what your company has said about this outbreak, and I represent people who were sickened by it. I want to say plainly that your letter does something the earlier statements did not: it changes what the company will do, not just what it says. Stopping the central Mexico iceberg harvest during the rainy season is the single most protective step a lettuce company could take on its own, and nobody made you take it. That deserves to be said first. The letter also leaves things out, and I will get to those. But the part worth stopping on is the task force, because a task force is only as good as its agenda, and I have been writing that agenda since July. Here it is, sorted by who has to act. You can put it on the table at the first meeting.

Your letter commits to four things, and the harvest pause is the one that matters.

You say the company will not harvest or process central Mexico iceberg for the U.S. and Canadian markets during the CDC-defined U.S. Cyclospora season, “which mirrors the rainy season in central Mexico”; that it is “expanding existing year-round health monitoring and increasing irrigation water and crop testing in central Mexico”; that it is “leading and investing in new research and technology to improve Cyclospora detection and prevention tools”; and that it will join the task force and “continue to collaborate with the FDA as it implements its Cyclospora Prevention, Response and Research Action Plan,” with updates at taylorfarms.com. The pause is the one that counts. Monitoring, testing, research and task forces are inputs. Not harvesting iceberg lettuce in central Mexico between May 1 and August 31 is an outcome, and it is the one step that would have prevented this outbreak if it had been in place on June 29, when the recalled lettuce started shipping.

Your letter does not name the months, does not count the sick, and does not mention the two positive samples.

The letter never gives a date. It borrows CDC’s definition of the season, which CDC states as May 1 through August 31, but a reader would not know that, and it does not say whether “indefinitely” means 2027 or every year. It never says how many people got sick: FDA’s final count is 12,883 ill, 570 hospitalized and two dead, both in Michigan, and CDC’s season count, which includes thousands of illnesses never tied to any food, stands at 19,883 confirmed cases, 1,064 hospitalizations and two deaths in 49 states and the District of Columbia as of September 15. And it quotes FDA’s closing line, that “there is currently not enough evidence to conclusively determine how contamination occurred,” without the finding before it: FDA’s inspectors found Cyclospora in a tank holding outgoing wastewater at your Taylor Farms de Mexico processing facility and in a drainage ditch at one of the iceberg growers in the traceback. No lettuce tested positive, and your company’s information hubstill leads with that. I wrote on October 4 about why a negative lettuce test has never been the standard for CDC, FDA, USDA or your own trade groups. Your letter does not repeat that argument, which is progress. It does not retire it either.

DateEventSource
June 29 to July 16Recalled shredded iceberg lettuce shipped to foodservice in 31 states; Walmart Marketside retail in 15 statesFDA
July 17Taylor Farms de Mexico recalls all central Mexico iceberg lettuce; production suspendedFDA
August 17Last illness onset in the outbreakFDA
September 11CDC declares the outbreak overCDC
October 2FDA closes the investigation: 12,883 sick, 570 hospitalized, 2 dead, 21 states; two environmental positivesFDA
October 8Bruce Taylor letter: central Mexico iceberg harvest suspended during Cyclospora season; task force announcedTaylor Farms
May 1, 2027Next Cyclospora season opens; 205 days after the letterCDC

The task force has 205 days. Start with the eight things you can do without asking anyone.

Everything on this part of the list is within your own control, and most of it your company has already said it does in some form.

1. Put the harvest pause in writing: the dates, the products, the markets, what counts as central Mexico, and what would end it. A policy that lives in a letter can be reversed by a letter.

2. Test water for the parasite, not for a stand-in. Your website describes water testing for “indicator organisms.” FDA’s fact sheet says generic E. coli and fecal coliform testing will not identify Cyclospora cayetanensis. Test for the organism with FDA’s BAM methods and for human fecal markers such as HF183, and publish the results by ranch, source and date.

3. Publish the 2013 results. In August 2013, after the salad-mix outbreak traced to the same Doctor Mora region, FDA let your plant resume shipping on a sampling plan covering product and water, and you told reporters the company had tested its water sources and raw product. Thirteen years later I could not find one public result. Your company says roughly 2,000 samples taken in central Mexico since May 2026 were negative. Say what they were, where they came from and what method was used, and do the same for 2013.

4. Close the loop on wastewater. FDA found the parasite in a tank of outgoing wastewater at your plant. Say where that water went, whether it could reach a field, a canal or a product line, and what has changed so that it cannot.

5. Deal with the open holding ponds. FDA’s 2013 environmental assessment described ranches pumping deep well water into elevated holding ponds, some unlined. Well water that sits in an open pond in a warm climate is no longer well water in any risk sense. Line them, cover them, or treat the water at the point of use with something validated against parasites, not chlorine validated against bacteria.

6. Redo the hazard analysis the 2013 assessment asked for. Recommendation #2 told the firm to decide whether Cyclospora is a reasonably likely hazard in the region and re-evaluate the wash step. FDA’s August 2026 fresh-cut guidance now says no known antimicrobial controls Cyclospora and that control has to come through the supply chain. Under 21 CFR 117.170 that is new hazard information, and it requires a reanalysis. Publish it.

7. Verify worker sanitation and publish the audits. Toilets, handwashing, worker health screening, sick-leave practice and the water those facilities use, checked by an independent auditor, on every ranch that supplies the plant. Western Growers’ own CEO has said the industry should open its doors wider. Start here.

8. Build lot-level traceability now. Your company says it already has field-to-shipment chain of custody that allows real-time traceback. If so, the 2028 compliance date for the FDA traceability rule costs you nothing, and you should say so to Congress.

The industry groups you belong to can do four things before the next season without a single new regulation.

I wrote on October 3 about what the produce industry got right after spinach, got wrong, and should do next. Your company helped create the California and Arizona Leafy Greens Marketing Agreements and co-founded the Center for Produce Safety. Those groups, Western Growers and the International Fresh Produce Association built real things after 2006. They can build these, and you are in a position to ask.

9. Sign one letter asking Congress to repeal the enforcement bar on the FDA Food Traceability Rule and let FDA enforce it on a near-term date, before the 2027 leafy greens season. IFPA has said on the record it opposed the delay. The LGMAs and Western Growers should say it in writing, and FMI and NGA, which applauded the delay to July 20, 2028, should withdraw that applause. Growers, packers and buyers should comply now; Western Growers already has a guidance document.

10. Write a Cyclospora water standard into the LGMA metrics without waiting for FDA. The LGMA already requires treatment of surface water applied overhead near harvest, but the treatment is validated against generic E. coli. Water treatment is already mandatory; it is aimed at the wrong organism. Add parasite testing of growing and processing water, starting in regions with outbreak history, and make the LGMA standard the floor for anything sold under a member’s name, wherever it is grown.

11. Agree now on data sharing. Shipping records, sourcing and test data, including Western Growers’ GreenLink testing, delivered to CDC and FDA within hours of a request, not after a negotiation. This outbreak was recognized in early July and the recall came July 17; the days in between were the days the lettuce was eaten.

12. Stop arguing with the epidemiologists and stop funding the deflection. The industry paid for the research showing Cyclospora is endemic in U.S. wastewater and irrigation water. It should not also be the industry that tells state health departments to look at swimming pools. Put the Center for Produce Safety’s next dollars into a validated parasite kill step or water treatment and into an in vitro culture method, because every inactivation study we have rides on a surrogate organism.

FDA has ten commitments. Ask it for the six that bind.

I wrote on October 7 that FDA’s post-outbreak plan is a start and that none of its ten items requires a grower, packer or importer to change a practice before next summer. The plan promises surveillance, outreach, training, lab capacity in Mexico, weather data, expert panels, one genotyping standard, more Foreign Supplier Verification Program inspections and an investigation report with no date. You will be across the table from FDA on this task force. Here is what to ask for, most of it under authority the agency already has.

13. Name the parasite in the water rule. The agricultural water provisions of the Produce Safety Rule carry one numeric microbial criterion, generic E. coli, and the 2024 pre-harvest rule replaced numeric testing with a systems-based assessment. Ask for a numeric standard for pre-harvest and processing water on raw-eaten produce, parasite testing where Cyclospora has been found, and use of the assessment’s reach over adjacent land and human sewage sources, which already covers a swimming resort a few hundred feet from a plant.

14. Fix the fresh-cut guidance. The August 2026 draft says in one section that bacterial controls will in many cases control Cyclospora and in another that no antimicrobial works. It does not cite FDA’s own BAM 19b and 19c detection methods and does not name Mexico among endemic regions. The docket is open. Ask FDA to say what processors must test and where.

15. Enforce equivalence at the border. The FSVP expansion in FDA’s plan should require importers of Food Traceability List produce from regions with Cyclospora history to show parasite-specific water testing and worker sanitation verification, not a certificate that the supplier tests for generic E. coli. You import from one of those regions. Ask for the standard that applies to your competitors too.

16. Stop treating the name of an implicated firm as confidential. FDA kept Taylor Farms de Mexico’s name out of its advisories until your own recall supplied it, it still has not named the seed supplier in either of this fall’s sprout outbreaks, and on October 7 it named “ready-to-eat multi-ingredient chicken wraps” as the vehicle in a 38-person E. coli O157:H7 outbreak without naming a manufacturer, a brand, a retailer or a state, because the wraps were “proactively removed” and never called a recall. I am drafting two citizen petitions on exactly this, and I am asking you to read them before I file them. They get their own section below.

17. Put surveillance where the parasite lives. CDC’s National Wastewater Surveillance System covers roughly half the country for respiratory viruses and does not test for Cyclospora. Ask that it be added, and ask CDC to restore required FoodNet reporting for Cyclospora, which it made optional on July 1, 2025, so that next year’s count is a count and not a guess.

18. Ask FDA to use Section 361 of the Public Health Service Act to get onto implicated animal feeding operations and sample, once the agency determines in writing that an operation is implicated in a multistate outbreak. Eight years after Yuma there is still no enforceable setback between a feedlot and a canal, and FDA still has no standing right to walk onto the feedlot. That is the subject of my third petition, and a grower’s signature on it would carry more weight than mine.

Congress holds the money and the traceability delay, and you have been to Washington before.

19. Ask Congress to strike the appropriations language that bars FDA from enforcing the Food Traceability Rule before July 20, 2028. The delay was announced by FDA and then written into the November 2025 appropriations act. One sentence put it there; one sentence takes it out. You have said your company already complies. Say that to the subcommittee.

20. Ask Congress to rebuild the trip wire. USDA’s Microbiological Data Program sampled produce at distribution centers for about $5 million a year and triggered 23 recalls in 2010 and 2011 before it was zeroed out in 2012, seven months before FDA first walked into Doctor Mora. It tested for bacteria, so it would not have caught Cyclospora; the honest version is that we dismantled the program we had and never built one for the parasite. A successor that tests for both would cost less than one week of this outbreak.

21. Ask Congress to fund the people who find outbreaks. State and local health departments do most produce inspections and every retail inspection, and they are the ones who recognized this outbreak. Restore the state and local public health money, fund state labs to run Cyclospora stool tests for outbreak specimens at no charge to the clinic, and fund the sequencing and genotyping that turned 12,883 scattered illnesses into one outbreak.

22. Support an independent outbreak investigation board on the NTSB model, with a clock. The 2013 environmental assessment’s Recommendation #2 had no addressee, no deadline and no one tracking it, which is how it could sit for thirteen years. A board with a 90-day response requirement, a public docket and a mandatory launch trigger for multistate outbreaks would have had this summer’s findings in public before the next season instead of in a report with no date. Your company would be a party to those investigations, with access and without a vote, the way an airline is at the NTSB.

23. Answer the letters. Fourteen congressional letters went to FDA, CDC, HHS and Taylor Farms this summer, and most of the deadlines passed without an answer. Yours is the one you control.

Two draft citizen petitions I am asking you and the leafy greens industry to read, improve and support before I file them.

Both are drafts, dated October 8, 2026, the day of your letter, and both will go to FDA under 21 CFR 10.30. I have not filed them. I am still taking comments, and I would rather fix what I got wrong now than argue about it on the docket later. Neither asks for a new testing regime or a new cost on a grower. Each asks FDA to tell the public what it already knows, which is the one reform that costs the honest company nothing and costs the whole industry a great deal when it is missing.

The first draft asks FDA to establish by rule that the identity of a firm implicated in a foodborne illness outbreak by epidemiologic, traceback, laboratory or whole genome sequencing evidence is not confidential commercial information under 21 CFR 20.61, with the burden on the firm to show otherwise on the record; to reach the grower, harvester, cooler, processor, distributor, importer and retailer, not only the consumer-facing brand, because lettuce moves from field to plate with no logo on it; to use the authority FDA already holds under section 705(b) of the Food, Drug, and Cosmetic Act to name implicated firms now, whether or not product remains in commerce and whether or not there is a recall; and to publish, while an investigation is open, the suspect food, the ingredients under investigation, the states, the hospitalizations and the HUS cases. FDA has named farms, processors and brands in exactly these circumstances at least eight times since 2006. What is missing is a written standard, and the petition supplies one.

The second draft asks FDA to amend 21 CFR part 7 to publish the retail consignee list in every Class I food recall, on the model USDA adopted for meat and poultry in 2008 at 9 CFR 390.10; to publish it when the recall is announced and update it; to reach restaurants, schools, hospitals and other institutional consignees, where unbranded produce actually goes; to classify every recall within ten calendar days and publish the interval; and to treat the removal of an outbreak-implicated food as a recall for these purposes whether the firm calls it a recall, a market withdrawal or a proactive removal. Congress told FDA in 2011 to consider the USDA policy. FDA agreed with it in substance and wrote a guidance that applies in some cases. A consumer who bought recalled ground beef can find out whether their store received it. A consumer who bought recalled bagged salad usually cannot.

Here is why these are your petitions as much as mine. When FDA will not name the firm, the whole commodity wears the outbreak. In 2018 the industry asked the country to stop eating all romaine because no one could say whose romaine it was. This summer, every grower of iceberg lettuce who had nothing to do with central Mexico lost sales for weeks because the advisory said “iceberg lettuce” before it said Taylor Farms de Mexico. A written naming standard protects the companies that are not implicated. A consignee list tells a shopper in Ohio that their store never carried the product. Transparency is not a penalty on the industry; secrecy is. You and the LGMAs, Western Growers, IFPA and the Center for Produce Safety can engage now, while they are drafts: tell me what is wrong with them, what the industry would need changed to sign, and what I have missed. When they are filed, support them by co-signing, by filing comments on the docket, or by writing FDA on your own letterhead saying that the leafy greens industry wants to be named when it is implicated and cleared when it is not. I will send both drafts to you and to anyone in the industry who asks, and I will post them here when they are ready.

None of this is new. It is the list your industry asked for in July, in one place, with names next to each item.

I wrote the short version in July as Reap What You Sow, when the count was a tenth of what it became, and I wrote the same month that there is no kill step for Cyclospora, which is why this whole list is about keeping the parasite out of the water and off the field rather than washing it off the lettuce. On October 8, the day of your letter, I published ten ways to win back public faith in the food safety system; the items above are the lettuce-specific version.

Your task force has no roster, no chair and no date. If you want it to be more than a sentence in a letter, publish all three, put this list on the table, and report on May 1, 2027 which items are done. Since 1993 I have read a great many company statements after outbreaks. Most say the company is cooperating and stands behind its food. Yours says the company will stop doing the thing that got people sick, for the months when it gets people sick. That is a better letter than most. The 12,883 people in FDA’s count, and the families of the two who died, are owed the rest of it: the dates, the numbers, the test results and the names. I will be reading taylorfarms.com for the updates you promised, and I will report what is there. Read the two draft petitions, tell me what to fix, and bring the industry with you when they are filed. If the task force wants a victims’ representative at the table, I know several who would come.

Sincerely,

Bill Marler

Gallup released new polling today and the numbers should make everyone in government and the food industry very uncomfortable.

Only 65% of Americans are now very or somewhat confident that food sold in grocery stores is safe to eat. That is the lowest Gallup has ever recorded, down from 73% last year and 81% in 2019. Confidence in the federal government to ensure food safety is worse: 47%, a record low, down from 68% in 2019 and 85% back in 2004. For the first time, a majority of Americans have little or no confidence in the government to keep their food safe.

And people are acting on it. Seventy-three percent say they avoided certain brands or types of food in the past year because of a recall or advisory, up from 53% in 2024. Forty-five percent threw out or returned food. And 42% say they worried that something they ate may have been contaminated, a trend high.

Gallup ties the drop to the Cyclospora outbreak that ran from June until it was declared over on September 11, which Gallup describes as the largest in U.S. history, with more than 12,000 sick across 21 states. Those of us who have been tracking state health department numbers know the real count was far higher. That gap is part of the problem.

Gallup also found that confidence in the government is sharply split by party: 70% of Republicans are confident, 30% of Democrats. But here is the part that matters most to me: the behavior is not partisan. Large majorities of Republicans (63%), independents (73%) and Democrats (81%) all say they have avoided foods because of recalls. Salmonella, E. coli and Cyclospora do not check voter registration. Neither should food safety policy.

I have been doing this work since Jack in the Box in 1993. Confidence is not restored by press releases. It is restored by transparency, by prevention, and by accountability. Here are ten things I would do, starting now:

  1. Tell people where recalled food went. When FDA issues a Class I recall, consumers should be able to see the list of retail stores that received the product. Right now, people are told to check their refrigerators for a lot code they will never find. I have a citizen petition pending at FDA asking for exactly this.
  2. Name the names. When FDA or CDC links an outbreak to a company, the identity of that company should not be treated as confidential business information. Hiding who made people sick protects no one but the company. My second petition asks FDA to stop doing it.
  3. Count the sick. You cannot fix what you will not measure. CDC should restore full FoodNet surveillance of all the pathogens it once tracked, starting with Cyclospora. An outbreak that state health departments count at many times the federal number is a surveillance failure.
  4. Stop delaying traceability. The FSMA food traceability rule was supposed to let regulators trace contaminated produce in days, not weeks. Congress pushed compliance to 2028. Every outbreak between now and then will be slower to solve than it needed to be.
  5. Find the source, not just the vehicle. Leafy greens outbreaks keep pointing back to nearby cattle operations. FDA should sample at the animal feeding operations adjacent to implicated fields during outbreak investigations. That is my third petition.
  6. Fund the people who do the work. FDA and USDA inspectors, and especially state and local health departments, are the ones who find outbreaks and stop them. Cutting their budgets and staff and then expressing surprise when outbreaks get bigger is not a policy.
  7. Make Salmonella in poultry an adulterant. USDA had a framework to keep the most dangerous Salmonella levels out of raw poultry and withdrew it. E. coli O157:H7 has been an adulterant in ground beef since 1994, and the industry adapted. Poultry can too.
  8. Warn people about high-risk foods. Some foods carry inherent risk that consumers deserve to know about at the point of purchase. I am finishing citizen petitions seeking warning labels on raw milk cheese and raw sprouts, and I welcome comments through October 15.
  9. Hold executives accountable. Ten people died in the Boar’s Head Listeria outbreak. Where are the DOJ and USDA Inspector General investigations? Stewart Parnell went to prison for knowingly shipping Salmonella-tainted peanut products. Nothing focuses a boardroom on food safety like the prospect of a federal courtroom.
  10. Take the politics out of it. Food safety should not rise and fall with whoever is in the White House. A single, independent, adequately funded food safety agency, instead of a patchwork split across FDA, USDA and others, would serve every American regardless of party.

I have said for years that I would be happy to be put out of business. The Gallup numbers tell me the public would be happy too. Lost confidence is earned back the same way it was lost: one outbreak at a time. It is time government and industry started earning it.

https://www.marlerblog.com/files/2026/10/Listeria-Peaches-2025.pdf

If you want to know what is really going on in food safety, read eFoodAlert. Phyllis Entis, the FoodBugLady, did it again today – this time pulling an FDA CORE investigation report through FOIA and then doing the detective work the government should have done for the public in the first place.

Here is what she found. In 2025, eight people were sickened by Listeria monocytogenes in an undisclosed number of states. The suspected vehicle: California peaches. Only two of the ill could be traced back, but both tracebacks led to the same distributor and packer. FDA inspected that packer, issued a Form 4056 on October 9, 2025 citing equipment and sanitation recordkeeping problems, and found Listeria in water, environmental, and produce samples – though none matched the outbreak strain.

The company’s own root cause work then turned up presumptive positives on a set of brushes. That led to the October 29, 2025 Moonlight Packing recall of yellow and white peaches shipped to more than 30 states, Canada and Mexico, followed by peach salsa recalls from Supreme Produce and JFE Franchising sold at Kroger stores. Phyllis’s working theory – that the brushes replaced in September may have carried the outbreak strain – is the simplest explanation. As she puts it, “we’ll never know.”

This is not new. In 2023, CDC linked 11 Listeria illnesses in 7 states – ten hospitalized, one death – to HMC Farms peaches, plums and nectarines. To its credit, HMC Farms published a 109-page list of every retail store that received the recalled fruit. That is what real transparency looks like.

Which brings me to the best part of Phyllis’s piece. FDA redacted the food, the states, the packer, and the retail chain from the report – information that was, for the most part, already public if you knew where to look. Phyllis knew where to look. She followed the unredacted crumbs (the recall date, the 2016 prior inspection) straight to Moonlight Packing.

Her bottom line is mine too: excessive redactions waste time and protect no one. That is exactly why I have asked FDA, through citizen petitions, to name the firms tied to outbreaks and to publish recall consignee lists. Consumers should not need a microbiologist with a FOIA habit to learn what made people sick – but thank goodness we have one.

Thanks, Phyllis. Read the whole post here.

On October 7, 2026, FDA’s outbreak investigation table named the vehicle in the E. coli O157:H7 outbreak it shares with USDA, FDA #1421 and FSIS 2026-04: “ready-to-eat multi-ingredient chicken wraps.” Thirty-eight people are sick. FDA said the wraps “were proactively removed from the market before the link to the outbreak was confirmed,” are past shelf life, and that the agencies are now looking at “possible ingredient level contamination.” FSIS’s outbreak table says it is working “to identify the contaminated ingredient and whether it was used in other products.” Food Safety News confirmed today that neither agency has disclosed the brand or the location.

I wrote earlier about what the agencies have and have not said. This post is about why it keeps happening, and about the two citizen petitions I have written to FDA to stop it.

There are two separate holes in the federal record, and this outbreak fell through both.

The first hole is the name. FDA treats the identity of a company linked to an outbreak as confidential commercial information unless a recall attaches to it. No recall, no name. The second hole is the store list. Even when there is a recall of an FDA-regulated food, publishing the stores that received it is a matter of agency discretion under a 2020 guidance, not a rule. And because these wraps were “proactively removed” rather than recalled, there is no recall to classify and no consignee list to publish under either agency’s practice. A family that ate a chicken wrap in September cannot learn whose it was or where it was sold.

The first petition: the name of a company whose food made people sick is not a trade secret.

The outbreak firm disclosure petition asks FDA to amend its disclosure regulations, 21 CFR part 20, to say plainly that the name and location of a firm implicated in an outbreak by epidemiologic, traceback, laboratory or genomic evidence is not confidential commercial information. It asks that the rule be written with the exception closed, so that a firm that wants its name withheld has to prove, on the record, why. It reaches the whole supply chain, the grower, the processor, the manufacturer, the distributor and the retailer, because in a produce outbreak there is often no brand to name at all. It asks FDA to publish what it knows while an investigation is open: the suspect food, the states, the hospitalizations, the cases of hemolytic uremic syndrome, and in a multi-ingredient product like this one, the ingredient under investigation. And it asks FDA, in a joint file like #1421, to coordinate with FSIS so that what the public learns about one outbreak does not depend on which agency regulates the finished food.

FDA does not need new legislation to do any of this. Section 705(b) of the Food, Drug, and Cosmetic Act lets the agency disseminate information about food in situations involving imminent danger to health, and its last sentence says that nothing in it prohibits the Secretary from “collecting, reporting, and illustrating the results of the investigations of the Department.” That clause has no imminent-danger trigger. It reaches the results of an outbreak investigation after the product is gone, which is exactly when FDA has been saying it has nothing to report.

FSIS used to be the agency that named names. Not this time.

FSIS’s longstanding practice, when meat or poultry is implicated and no longer for sale, is to issue a public health alert that names the establishment. It did that as recently as May. When E. coli O157:H7 was linked to beef kofta served at The Kebab Shop, FSIS issued a public health alert naming the restaurant chain and the producer of beef that had been made in January and was no longer available. California alone reported nine cases, five hospitalizations and two cases of HUS.

The chicken wraps are FSIS-regulated. They are no longer for sale. Thirty-eight people are sick and an inspection is underway. There is no alert. When the agency whose routine is to name falls silent in a joint file with FDA, the problem is no longer one agency’s habit. It is the absence of a written standard that binds both.

The second petition: tell people which stores got the food, and close the “proactive removal” loophole.

USDA settled the consignee question by rule eighteen years ago. Under 9 CFR 390.10, when meat or poultry is recalled in a Class I recall, FSIS publishes the names and locations of the retail stores that received it. In 2011, Congress told FDA in the Food Safety Modernization Act to consult that policy and consider adopting it. FDA consulted it and, in November 2020, issued guidance saying it intends to publish store lists mainly when a food cannot easily be identified from its packaging and is still likely to be available for consumption. Guidance binds no one. And the second criterion, still available for consumption, means that a food already past shelf life, like these wraps, may never get a list even when it is recalled.

The recall consignee petition asks FDA to write the USDA approach into its own recall regulations: publish the store list in every Class I food recall, at the time the recall is announced, and extend it to restaurants, schools, hospitals and other institutions. It asks FDA to classify every recall within ten days and publish the interval. And, because of what happened this month, it now asks for one more thing.

FDA’s own recall regulation, 21 CFR 7.3, defines a “market withdrawal” as a removal involving a minor violation that would not be subject to legal action, or no violation at all. A ready-to-eat food that has made thirty-eight people sick is neither. The petition asks FDA to provide by rule that when a food has been identified as the suspected vehicle of an outbreak, its removal is a recall for purposes of classification and the store list, whatever the firm calls it and whether or not the product is still within its shelf life. A consignee requirement that attaches only to the word “recall” can be avoided by not using the word.

“Past shelf life” answers the wrong question.

FDA’s reason for saying nothing is that no one can buy the wraps now. That protects the next customer. It does nothing for the thirty-eight people already sick, or for the people who have not yet been counted, because E. coli cases take three to four weeks to show up on a federal table. A parent whose child ate a chicken wrap in September and now has bloody diarrhea needs to know the brand and the store, and needs to tell the emergency room, so the child is not given antibiotics or anti-diarrheals that raise the risk of HUS. A health department interviewing a patient needs to know which store to ask about. And if the contaminated ingredient went into other products, which is what both agencies now say they are investigating, the people eating those products need to know more than a category.

This is not new, and it is not just about wraps.

FDA closed a fourteen-person romaine E. coli outbreak, #1382, on September 10 and named no grower and no processor because the lettuce was past shelf life. It closed an eighty-nine-person romaine outbreak in late 2024 that hospitalized thirty-six people and killed one, and named no one; the traceback, it turned out, had converged on a single processor and a single grower the whole time. And FDA has named farms, processors and brands in exactly those circumstances at least eight times since 2006. What is missing is not authority. It is a rule.

FDA’s own 2026 record makes the point. In the Salmonella Newport outbreak linked to Guatemalan cantaloupe, seventy people in twenty-five states, FDA said the fruit was likely past shelf life. The importer, Ayco Farms, recalled a lot anyway, FDA put two growers on import alert, and all three were named. Four months later, romaine past shelf life got no recall and no name. The difference was not shelf life. It was whether a recall happened to attach. Even then, FDA’s executive summary of the cantaloupe outbreak redacts the states, and the closed-table row leaves the recall column blank.

And the chicken wraps are not the only open file without a name. As of October 7, nine of the fifteen active investigations on FDA’s table name no food at all. Those nine account for 619 sick people, and five of them are outbreaks the table still lists as ongoing.

Both petitions also support the citizen petition Stop Foodborne Illness filed in February asking FDA to stop treating company names as confidential. FDA told Stop in July that it had not been able to reach a decision. Thirty-eight more people are now waiting with them.

The produce industry should want this as much as consumers do.

When the government names a commodity and stops, consumers walk away from the whole category. In July, during the Cyclospora outbreak, Numerator data showed 6.5 million households stopped buying salad mixes and kits. Every grower and processor paid for that, including the ones who did nothing wrong. A firm-specific disclosure is the only thing that separates them. Today, “ready-to-eat multi-ingredient chicken wraps” puts every maker of chicken wraps in the country, and every supplier of whatever ingredient turns out to be the problem, under the same cloud.

Why hasn’t FDA or USDA named the company that made the chicken wraps?

As of October 8, 2026, neither agency has said. FDA says the wraps were removed from the market before the outbreak link was confirmed and are past shelf life, so there is no recall and no advisory. FSIS, which regulates the wraps, has not issued a public health alert.

What would the two petitions change?

The disclosure petition would make the name of a firm implicated in an outbreak public by rule, whether or not there is a recall, and would require FDA to publish the suspect food, states, hospitalizations and HUS cases while an investigation is open. The consignee petition would require FDA to publish the list of stores and institutions that received a Class I recalled food, and would treat the removal of an outbreak-implicated food as a recall even when the company calls it something else.

As of October 7, 2026, FDA’s outbreak investigation table says the E. coli O157:H7 outbreak it has been working with USDA since September, FDA reference #1421 and FSIS 2026-04, has a vehicle: ready-to-eat multi-ingredient chicken wraps. Thirty-eight people are sick. FDA has not disclosed hospitalizations, deaths, kidney failures, the states involved, who made the wraps or who sold them. There is no recall and no consumer advisory, because FDA says the wraps left the market before the link was confirmed.

The product line changed from “Not Yet Identified” to “Multi-ingredient wrap with chicken (suspect)” on October 7.

The table was republished Wednesday afternoon. The What’s New entry reads, in full: “For the outbreak of E. coli O157:H7 (ref #1421), the vehicle has been identified as ready-to-eat multi-ingredient chicken wraps. These USDA-regulated wraps were proactively removed from the market before the link to the outbreak was confirmed and they are no longer available for sale and past shelf-life. FDA, in coordination with USDA, CDC, and state and local partners are continuing to investigate the source of the outbreak including possible ingredient level contamination. If it is determined that there is still an ongoing risk to the public and actions can be taken to protect consumers, the agencies will issue an advisory.” A second entry says FDA has initiated an inspection. The row now shows traceback, on-site inspection and sampling checked, and the recall column blank.

That is everything FDA has told the public. The case count is the same 38 it was on September 30. FSIS’s outbreak table now carries the same product line for 2026-04, “Ready-To-Eat Multi-ingredient wrap with chicken (suspect),” with one sentence of its own: “The wrap identified through the investigation at this point is past shelf-life and no longer available for purchase. FSIS is working with FDA to identify the contaminated ingredient and whether it was used in other products.” CDC’s current outbreaks page, updated the same day, counts eight active multistate E. coli investigations and names none of them.

The two people who called me in late September described exactly this product.

On September 29 I wrote about two calls that came in twenty-four hours apart. Both callers had culture-confirmed E. coli. Both had been told by their health departments that they were part of a multistate outbreak linked to a food that had not been named. Both had bought a meat-and-vegetable sandwich wrap at the same chain, in different states. I said then that two interviews are not an epidemiologic study, and they are not. But a ready-to-eat wrap with chicken in it is the product they described, and the fact that it sits under two reference numbers is the reason I guessed it was a wrap in the first place: FSIS treats a wrap that contains meat or poultry as its product, while the lettuce, the tomatoes and the tortilla inside it belong to FDA. Two agencies, two tracebacks, one sandwich.

My epidemiologists have requested the health department, CDC, FDA and FSIS records on both callers. When those arrive I will say what they show.

“Ingredient level contamination” means the investigation has moved from the wrap to what went into it.

Read the second half of FDA’s sentence again. The agencies are “continuing to investigate the source of the outbreak including possible ingredient level contamination.” A chicken wrap is chicken, a tortilla, and usually lettuce or other greens, cheese, and a sauce. If the chicken were the problem, the file would belong to FSIS alone. FDA opening an inspection and collecting samples tells you the agencies think the contamination may have arrived in an ingredient that goes into other products too, and that is the only reading under which a wrap that is already past its shelf life still justifies a federal investigation with three actions checked. FSIS says it plainly: it is working “to identify the contaminated ingredient and whether it was used in other products.” If a produce ingredient carried E. coli O157:H7 into these wraps, the question is where else that ingredient went, and both agencies have now said in writing that they are asking it.

The count grew 52 percent in a week and has not moved since, which is what the reporting lag predicts.

FDA table stampSickProduct columnActions checkedChange
Sept 23, 2026 (row posted)25Not Yet IdentifiedTracebackFirst public listing
Sept 30, 202638Not Yet IdentifiedTraceback, sampling+13 sick (52%)
Oct 7, 202638Multi-ingredient wrap with chicken (suspect)Traceback, inspection, sampling+0 sick; vehicle named

Source: FDA CORE Outbreak Investigation Table, stamps of Sept 25, Sept 30 and Oct 7, 2026, read on each date. Check: 25 + 13 = 38; 13 ÷ 25 = 0.52.

CDC says it typically takes three to four weeks from the day someone gets sick to the day their isolate is sequenced and matched to an outbreak. The 38 people on the table were infected in late August and September. People who ate a wrap in the last week it was on sale may not appear on the table until late October. The number is a floor, as I wrote when it was 25 and again when it was 38.

“Past shelf-life” protects the next customer and does nothing for the people already sick.

FDA’s logic for not issuing an advisory is that no one can buy the wraps now. That is true and it is beside the point for the families in this outbreak. E. coli O157:H7 causes bloody diarrhea and severe cramps three to four days after exposure, and in five to ten percent of cases, most of them children, it progresses to hemolytic uremic syndrome, kidney failure that can be permanent and can kill. A parent whose child ate a chicken wrap in September and now has bloody diarrhea needs to know that wrap is a suspect, and needs to tell the emergency room so the child is not given antibiotics or anti-diarrheals, both of which raise the risk of HUS. That information is useful today whether or not the wraps are still for sale. It is useful to the health departments interviewing patients. It is useful to the retailer’s other customers, who have loyalty-card records that would show whether they bought one. None of them can act on “ready-to-eat multi-ingredient chicken wraps” without a brand.

The agencies have named products mid-investigation before, on this same table.

FSIS’s own table shows how unusual this silence is. Every other joint FDA–FSIS file on it carries a public notice that names the food and the company: the 2025 Fresh & Ready Foods Listeria file (FDA #1305, USDA 2025-06, ten sick, all hospitalized, one dead), the 2025 FreshRealm chicken fettuccine alfredo Listeria file (FDA #1290, USDA 2025-05) with a public health alert and a recall, and the October 2024 McDonald’s Quarter Pounder E. coli O157:H7 file (USDA 2025-01), where CDC, FDA and FSIS named the restaurant while the onions were still being traced. FSIS’s two other 2026 files got the same treatment: the May beef kofta E. coli O157:H7 outbreak at The Kebab Shop got a public health alert naming the chain, and the May headcheese Listeria outbreak got one naming the product. File 2026-04 is the only active row on the table and the only one of those six with no notice at all. The agencies have a product, 38 sick, samples in the lab and an inspector on site, and have published a category.

What FDA and FSIS should post now.

The brand and the retailer. The states, so local health departments and physicians know to look. The onset dates. How many of the 38 were hospitalized and how many developed HUS. Which ingredient each agency is tracing, since FDA’s own sentence says that is where the investigation is. And whether any of the ingredients in these wraps were sold in other products that are not past their shelf life. If the answer to that last question is yes, the advisory FDA is holding in reserve is already overdue.

What food caused the E. coli O157:H7 outbreak FDA #1421?

FDA’s outbreak table, updated October 7, 2026, says the vehicle is ready-to-eat multi-ingredient chicken wraps regulated by USDA. FDA has not named the brand, the manufacturer or the stores that sold them, and is still investigating whether a single ingredient was the source.

Were the chicken wraps recalled?

No. FDA says the wraps were removed from the market before the outbreak link was confirmed and are past their shelf life, so there is no recall and no consumer advisory. Thirty-eight people are sick as of October 7, 2026.

I ate a ready-to-eat chicken wrap in September and got sick. What should I do?

See a doctor and ask for a stool culture that tests for Shiga toxin-producing E. coli. Do not take antibiotics or anti-diarrheal medicine unless a physician who knows it may be E. coli tells you to. Keep receipts, loyalty-card records and any packaging, write down the date and the store, and tell your local health department.

On October 2, FDA closed its investigation into the largest Cyclospora outbreak in American history: 12,883 confirmed illnesses, 570 hospitalizations and two deaths in 21 states, linked to shredded iceberg lettuce from Taylor Farms de Mexico. Inspectors found the parasite in a wastewater tank at the processing plant and in a drainage ditch at a grower. As of September 15, CDC had counted 19,883 laboratory-confirmed cyclosporiasis cases in the United States this year. That is not a bad season. That is a public health failure.

The same day, FDA posted its post-outbreak response plan: ten things it says it will do before the 2027 growing and harvesting season. I read it twice. Most of it is good. Some of it is overdue. And a great deal of what would prevent the next outbreak is not there. Here is FDA’s list, followed by mine.

What FDA says it will do

Paraphrasing FDA’s ten commitments, with a word or two from me on each:

  1. Publish an Outbreak Investigation Report on how Cyclospora got onto imported shredded iceberg lettuce, with recommendations. Good. But there is no date. It needs to be out well before the 2027 season, and it needs to include the water data.
  2. Increase surveillance of commodities historically associated with Cyclospora. Good, if it means sampling and publishing results, not just more meetings.
  3. Do more outreach at home and abroad on the Produce Safety Rule, the Preventive Controls Rule and the Food Traceability Rule. Outreach on a traceability rule that Congress has barred FDA from enforcing until 2028 is a curious use of time. More on that below.
  4. Build laboratory capacity in Mexico so samples can be analyzed in-country, faster. Yes.
  5. Use weather and environmental data to spot conditions that spread Cyclospora. Sensible, and cheap.
  6. Expand training with Mexico’s agriculture ministry, COFEPRIS and SENASICA. Training is fine. Verification is better.
  7. Convene expert panels on worker health and hygiene, water and wastewater monitoring, and gaps in growing and processing practices. This goes straight at the problem. These panels should meet in public and include consumer and public health voices, not only industry.
  8. Align Cyclospora genotyping with CDC into a single standard for government, partner nations and industry. This is the most important item on the list for tracing outbreaks, and it needs real money behind it.
  9. Expand Foreign Supplier Verification Program inspections so importers consider Cyclospora in their hazard analysis. Good. Publish what the inspections find.
  10. Update the Cyclospora Prevention, Response and Research Action Plan with lessons learned. Fine, but an action plan is only as good as what it requires.

FDA also sent a letter to industry asking for collaboration. I am glad it did. But notice what all ten items have in common: they are surveillance, studies, training and panels. None of them requires anyone who grows, packs or imports produce to do anything differently next summer.

What FDA left out

Some of what follows FDA can do on its own. Some needs Congress. Some the produce industry could do tomorrow if it chose to. I have written about most of it before, here and in Reap What You Sow. It belongs in one place.

1. Unwind the traceability delay. FDA’s Food Traceability Rule was supposed to take effect January 20, 2026. FDA pushed compliance to July 20, 2028, and Congress then wrote the delay into the November 2025 appropriations act. The Safe Food Coalition asked Congress in August to rescind it. Congress should, and FDA should say publicly that it wants the authority back before the 2027 season. In the meantime, everyone who grows, packs or buys leafy greens and the other foods on the Food Traceability List should comply now. This summer, millions of heads of California lettuce that had nothing to do with the outbreak were plowed underbecause nobody could say quickly enough where the bad lettuce went. The innocent paid for the guilty.

2. Treat Cyclospora as the water problem it is. Both of FDA’s positive samples from Mexico were water. Yet in 2024 FDA replaced numeric water testing with “systems-based” assessments, and today no law requiresa farm to test its irrigation water or its produce for Cyclospora. The washes the industry relies on are validated against generic E. coli, not a parasite that chlorine does not kill. What is needed:

  1. Enforceable, numeric microbial standards and routine testing for pre-harvest water used on high-risk produce eaten raw.
  2. Cyclospora and other parasites added to testing of growing and processing water at operations producing Food Traceability List commodities, starting in regions with an outbreak history.
  3. Processor wastewater controls that keep outgoing water away from fields, canals and product. FDA found the parasite in a Taylor Farms de Mexico wastewater tank. In 2013, after an earlier Cyclosporaoutbreak, Taylor Farms said it was testing water at that operation and FDA let it reopen on that promise. I have never found a public result.
  4. Research funding for a validated kill step or water treatment that works against parasites.
  5. Enforceable setbacks and watershed monitoring for animal feeding operations near produce fields and irrigation sources.
  6. The same standards for imports, enforced through FSVP, with results made public.

3. Count the sick again. On July 1, 2025, CDC dropped Cyclospora from FoodNet surveillance. When the biggest outbreak in history arrived, nobody was counting in the system built to count. Restore it, along with the other dropped pathogens, and fund the state and local labs that find outbreaks.

4. Rebuild the trip wire. The USDA’s Microbiological Data Program sampled produce in commerce for pathogens for about $5 million a year and triggered dozens of recalls before it was zeroed out in 2012. Rebuild it. It is the cheapest insurance policy the produce industry will ever be offered.

5. Finish the job on the other outbreaks. FDA’s list is about the lettuce outbreak. But this season FDA also opened four other Cyclospora investigations that sickened at least 313 people, and every one of them still lists the source as “not yet identified.” The Outbreak Investigation Report should explain why, and what it would have taken to solve them.

6. Agree on data sharing before the next outbreak. A standing protocol, worked out now, for industry to hand shipping, sourcing and test data to CDC and FDA within hours, so nobody is arguing with epidemiologists in the middle of an outbreak.

7. Verify sanitation at the farms that feed us. Cyclospora comes from human feces. Toilets, handwashing, worker health and water at farms supplying U.S. buyers should be checked by auditors who are not paid to pass. Training, which is what FDA proposes, is not verification.

8. Publish root cause analyses, all of them. FDA has promised one report. Taylor Farms should publish its own water results, from this year and from 2013. After every traced outbreak, the whole supply chain should get to learn what went wrong and what changed.

9. Stop rolling back FSMA. Every “burden” removed in the name of deregulation this decade was a tool someone needed this summer.

Three petitions

I have also drafted three citizen petitions to FDA that grow out of what went wrong this summer and, in the outbreaks, before it. I have not filed them yet, because I want the produce industry’s input, and ideally its signatures, first.

Name the firms. FDA named Taylor Farms de Mexico this time. Too often it does not, and an outbreak with no named firm becomes an outbreak blamed on an entire commodity. The first petition asks FDA to stop treating the identity of a firm implicated in an outbreak as confidential.

Publish the consignee lists. The recalled lettuce went to restaurants, institutions and stores across dozens of states, and consumers had almost no way of knowing whether the salad they ate came from one of them. USDA has published retail consignee lists for meat and poultry recalls since 2008. The second petition asks FDA to do the same in Class I recalls.

Let FDA sample where the evidence points. The third petition asks FDA to use its communicable disease authority under section 361 of the Public Health Service Act to require entry and sampling at an animal feeding operation once the agency has determined it is implicated in a multistate outbreak. That petition is aimed at E. coli and the leafy greens outbreaks of the past decade, not Cyclospora, which comes from people, not cattle. But the principle is the same one running through this whole post: FDA cannot fix what it is not allowed to look at.

Anyone who wants the drafts can have them. My email is bmarler@marlerclark.com.

Before the 2027 season

FDA has given itself until the 2027 growing season. That is about seven months. Its ten points will make the next investigation faster and smarter. They will not, by themselves, keep the parasite off the lettuce. That takes water standards, traceability that is enforced, verification on the farm, and a surveillance system that counts the sick. I would be happy to sit down with FDA and the industry and work on any of it. The cheapest outbreak is the one that never happens.

On October 5, 2026, the American Academy of Pediatrics published a policy statement in Pediatrics calling for a ban on the sale and distribution of raw milk and raw milk products, including raw milk cheeses, and telling pregnant people and children to consume only pasteurized dairy. It arrived while 13 people in nine states, more than half of them five years old or younger, are sick with E. coli O26:H11 from Graziers raw milk cheese made by Sierra Nevada Cheese Company of Willows, California. Eight are hospitalized. Three have hemolytic uremic syndrome. CDC last updated that count on September 25.

The pediatricians renewed a position they first took in 2014 and added bird flu to the list.

The statement, written by Adam J. Ratner, Anne Sardi and Mark R. Corkins for the Academy’s Committee on Infectious Diseases and Committee on Nutrition, replaces the January 2014 policy statement of the same two committees, which the Academy reaffirmed as recently as June 2025. The core has not moved in twelve years: unpasteurized milk and milk products from cows, goats and sheep continue to be a source of Listeria monocytogenes, E. coli O157, Salmonella, Campylobacter and Brucella infections, pasteurization greatly reduces that risk, and the claimed health benefits of raw milk lack evidence. What is new is H5N1. As News-Medical summarized the statement, the Academy notes that during the 2024 dairy cattle outbreak the virus turned up in close to a quarter of raw milk samples tested in affected areas and can stay detectable in refrigerated raw milk for weeks, though no human infection from drinking it has been confirmed. The same summary carries the two numbers that matter most to a parent: nearly half of raw dairy illnesses occur in people under 20, with a significant share in children under five, and listeriosis runs roughly 12 to 14 times more common in pregnancy than in the general population. I could not reach the full text through the journal’s site this morning, so the statistics above rest on the published abstract and on that report rather than on my own reading of every table.

Every risk the pediatricians describe has a name in this year’s outbreak files.

The Academy writes in the language of relative risk. The outbreak pages write in children. In the Graziers outbreak the median age is five, nine of nine people interviewed ate the cheese, and the company recalled every Graziers raw milk product in late September without lot codes because it could not say which batch was contaminated. Three of the thirteen developed HUS, the kidney failure that follows some Shiga toxin infections and that I wrote about on September 26 when the outbreak was announced. Last week ProPublica told the story of two little girls with HUS after raw goat milk from an unlicensed Riverside County dairy. The Academy’s statement does not mention either case. It does not need to. The children it is written for are the same ones.

Four outbreaks in thirty-one months came from cheese that followed the sixty-day rule.

Federal law has allowed raw milk cheese in interstate commerce since 1949 on one condition, found at 21 CFR 1240.61: the cheese must be aged at least sixty days. The Graziers labels read “Aged at least 60 days.” The table below is the record of the last four Shiga toxin E. coli outbreaks in cheese that met that rule, built from the agency pages linked in each row.

OutbreakCheeseSickHospitalizedHUS
Raw Farm, February 2024Raw cheddar, E. coliO157:H71152
Twin Sisters Creamery, October 2025Aged raw milk cheese, E. coli O103 and O261010
Raw Farm, March 2026Raw cheddar, E. coliO157:H7931
Sierra Nevada Graziers, September 2026Raw milk cheddar and jack, E. coli O26:H111383
Total 43176

Table 1. Shiga toxin-producing E. coli outbreaks in raw milk cheese aged sixty days or more, February 2024 to September 2026. Sources: FDA and CDC outbreak pages and Washington State Department of Health, as linked, read October 6, 2026. Check: 11 + 10 + 9 + 13 = 43 sick; 5 + 1 + 3 + 8 = 17 hospitalized; 2 + 0 + 1 + 3 = 6 HUS.

Forty-three sick, seventeen in the hospital and six with kidney failure is what sixty days of aging bought. FDA knew this was coming. In 2013 it published, with Health Canada, a quantitative risk assessment that put the per-serving listeriosis risk from raw milk soft-ripened cheese at 50 to 160 times that of the pasteurized version, and in August 2015 it opened a docket to reconsider the sixty-day rule. Eleven years later the rule is unchanged and the docket is quiet.

Twenty-seven states allow the sale, and the package says nothing.

The Academy counts at least 27 states that permit raw milk sales in some form. Whatever a state decides about milk, the cheese travels. Graziers went to retailers nationwide and online. FDA’s labeling rule at 21 CFR 101.17requires a warning statement on unpasteurized juice and a safe-handling statement on shell eggs. It requires nothing on cheese made from unpasteurized milk. California’s warning rule exempts cheese aged sixty days, and Washington’s covers milk only. A parent standing at a cheese counter is given the age of the cheese and not the reason the age exists.

A ban and a warning label are not competing answers.

The pediatricians ask legislators for a prohibition. I am asking FDA for a sentence. The citizen petition I published on September 27 asks the agency to require a prescribed warning statement on cheese made from unpasteurized milk, including cut-to-order, imported and online sales, and to finish the sixty-day reevaluation it announced in 2015. The draft petition is online, and because so many of you wrote in, I extended the comment period to October 15 and will file shortly after. The Academy’s statement will go into the record as support, because the two asks rest on the same facts and differ only in who is being asked. Congress and twenty-seven legislatures can debate a ban for years. FDA can put a warning on a label under authority it already uses for juice. A choice made without the material fact is not really a choice, and a label puts the fact where the decision is made.

Here is what a parent can do today without waiting for either of us.

Do not give raw milk or raw milk cheese to a child under five, to anyone who is pregnant, or to anyone with a weakened immune system; that is CDC’s standing advice and now the Academy’s. Treat “aged 60 days” as a legal minimum, not a safety claim. If you have any Graziers raw milk cheese, the recall covers every product in every size with no lot codes, so throw it out. If a child has diarrhea that turns bloody, see a doctor the same day and ask for a stool culture; do not give antidiarrheal medicine, and let the doctor decide about antibiotics, which can raise the risk of HUS in Shiga toxin infections. I have been doing this since 1993, and the family I now represent in the Graziers outbreak did not get that paragraph on the package. The pediatricians and I would both like it there before the next one.