Three federal maps describe the 2026 Cyclospora Summer. Read in order, they move from what has been established, to what is documented but unexamined, to what nobody has yet explained.

CDC, Where People Got Sick: Cyclospora Outbreak, July 2026 — last reviewed July 16, 2026.

This part is settled. FDA’s traceback investigation identified convergence on a single supplier of iceberg lettuce, Taylor Farms de México, used by the Taco Bell locations where sick people ate before becoming ill. CDC reported 1,644 people infected with Cyclospora and reporting Taco Bell exposure across five states, with 94 hospitalizations and illness onsets running from May 13 to July 13. Michigan analyzed food exposure details from 190 of those cases, and 90 percent reported eating iceberg lettuce. The company announced a recall on July 17. The link from restaurant to supplier to recall is not in dispute.

Taylor Fresh Foods recall notice announced July 17 and posted by FDA July 18, 2026.

Then the same lettuce turns out to have gone much further. The recall notice states that the shredded iceberg product was distributed between June 29 and July 16 in twenty-seven states: Alabama, Arkansas, Connecticut, Florida, Georgia, Iowa, Illinois, Indiana, Kansas, Kentucky, Louisiana, Massachusetts, Maryland, Michigan, Missouri, Mississippi, North Carolina, New Hampshire, New Jersey, Ohio, Oklahoma, Pennsylvania, South Carolina, Tennessee, Texas, Virginia and Wisconsin.

CDC, Surveillance of Cyclosporiasis. Bands read from CDC’s published case-location map.

And this is the part nobody has explained. CDC’s surveillance page reports 4,173 laboratory-confirmed domestically acquired cases since May 1, 2026, plus more than 7,400 additional cases not yet laboratory confirmed, many of them from Michigan and Ohio — roughly 11,600 people across forty-two states and the District of Columbia. The five-state Taco Bell cluster is a subset of that. What accounts for the rest has not been established.

The question worth pressing is whether the distribution map explains the case map. It is not proof either way, but the pattern leans one direction.

Twenty-five of the twenty-seven states that received the recalled lettuce report cases — all but New Hampshire and South Carolina. That is 93 percent, against 74 percent of the states that did not receive it. On its own that comparison proves very little, because with cases in forty-two of fifty states almost any distribution list would overlap heavily.

The stronger signal is where the burden sits. Nine states report 81 or more cases. Eight of the nine received the recalled lettuce: Michigan, Ohio, Indiana, New Jersey, North Carolina, Illinois, Kentucky and Texas. Meanwhile the seventeen states with cases that are absent from the distribution list are overwhelmingly minimal — ten of them sit in the lowest band of one to ten cases, which is roughly what background cyclosporiasis looks like in a normal summer. The heavy states got the lettuce. The states that did not get the lettuce are mostly barely affected.

Two states break the pattern, and both are worth an answer. New York carries between 161 and 300 cases and does not appear on the distribution list at all — the only high-burden state that does not. West Virginia is one of the five states in CDC’s own outbreak map, with confirmed illnesses tied to Taco Bell locations FDA named, and it does not appear on the company’s list either.

Neither gap has an innocent explanation on the public record. Either the product reached those states through a channel the recall notice does not capture, or the two lists were built from different records, or New York’s cases have a different source entirely. Any of those is answerable with documents the company and the agencies already hold: the full customer list behind the recall, the distribution records for the thirty-four product lines the notice does not describe, and the state-level exposure interviews CDC has collected but not published.

Three limits on the comparison, all of which understate rather than overstate it. The twenty-seven-state figure describes the shredded iceberg line only; the recall spans thirty-five product lines, including the Marketside retail bags sold at Walmart, and the notice gives no distribution list for the rest — so the true distribution footprint is larger than twenty-seven, not smaller. The national case map counts all 2026 cyclosporiasis cases, not only those traced to this supplier, so not every shaded state is a Taylor Farms state.

FDA’s table of active foodborne illness investigations currently lists six separate Cyclospora outbreaks running at once. Exactly one has a product attached to it. Reference 1390 is the Taco Bell cluster, where FDA’s traceback converged on Taylor Farms de México and the company pulled its iceberg lettuce from the market. The other five are blanks. Referecne 1392, opened July 22, 72 illnesses, product yet identified. Reference 1385, opened July 8, eight illnesses, product not yet identified. Reference 1384, opened the same day, eighteen illnesses, product not yet identified. Reference 1381, opened June 17, two illnesses, product not yet identified. Reference 1375, opened June 3, eight illnesses — an outbreak FDA now lists as ended, with the investigation still open and the source still unknown. FDA has opened traceback on every one of them and collected samples in some. It has not conducted a single on-site inspection in connection with any of them, and not one has produced a recall.

That matters more than it looks. For this parasite, “not yet identified” resolves to “never identified” about half the time. FDA closed a Cyclospora investigation in July 2025 with 48 illnesses having never identified the product at all and closed another in August 2025 with 69 illnesses that it did manage to trace to parsley. Five open blanks during the largest cyclosporiasis outbreak in American history is not a bookkeeping curiosity. If a second contaminated commodity is moving through the food supply alongside the lettuce, those five files are where it would surface — and right now they are five traceback exercises with no inspections behind them.

In November 2013, after Cyclospora cayetanensis sickened hundreds of people in Iowa and Nebraska, FDA published an environmental assessment of the Taylor Farms de México processing plant at Doctor Mora, Guanajuato. The report closed with recommendations. The second told the firm to determine whether Cyclospora is a reasonably likely hazard in the Guanajuato leafy green growing region and, if it is, to re-evaluate the wash step used on salad mix. Thirteen years later the same region sits at the center of the largest cyclosporiasis outbreak in American history, and no one has produced a document showing that determination was ever made.

Here is what a hazard analysis would have found, had anyone performed one. Two hundred and thirty-five meters from the processing building — roughly eight hundred feet, a three-minute walk — sits Balneario Las Fajanas, a public thermal-water bathing complex with pools, water slides, changing rooms, showers, grills and picnic shelters, open every day of the year. It is the largest concentration of human fecal loading anywhere near that plant. And satellite imagery establishes that it was already built, filled and operating in March 2010, more than three years before FDA and COFEPRIS ever set foot on the property.

March 4, 2010. Taylor Farms de México at center; Balneario Las Fajanas at lower right, pools filled, buildings and mature tree cover in place. More than three years before the FDA and COFEPRIS assessment. Google Earth historical imagery.

That image forecloses the only innocent explanation. Nobody can now say the balneario came later, or that the environment changed after the inspectors left. When FDA and COFEPRIS walked that site in August 2013, a public bathing facility with filled pools stood across the highway in plain view and had stood there for years. The published assessment describes the processing plant and five ranches. It does not describe a bathing complex. 

It is worth setting out what is actually on that property, because the detail matters. The Guanajuato Secretariat of Tourism lists Las Fajanas in its official state guide under balnearios and water parks, at Km 16 of the San Miguel de Allende–Doctor Mora highway, locality of Cruz de la Maza, with state-published coordinates of 21.10266, -100.45159. The state describes thermal-water pools, extensive lawns, parking, water slides, palapas, grills, restrooms, showers, changing rooms and a snack shop, and flags the site as accessible. Other listings add a soda fountain, a store, sports courts and a bar. The operator advertises thermal water held at 40 degrees Celsius and promotes that the facility is open 365 days a year. Admission has climbed steadily — 80 pesos for adults and 40 for children in earlier listings, 100 and 40 after that, 120 and 60 from the first of February, and 150 adults and 80 children from the twenty-third of March. Prices rise like that when demand supports it. The Google listing carries 897 reviews. There is no website; the business runs on Facebook.

Water slides produce high water ingestion, particularly among children. Grills and picnic shelters mean families stay all day rather than an hour, which multiplies restroom use per visitor. Thermal water at 40 degrees means the facility is drawing from a deep geothermal source and moving large volumes of it — and every liter that goes into a pool eventually comes out of one. Where it goes when it leaves is the entire question, and no public listing answers it.

June 14, 2023. The same frame. The balneario is largely unchanged. The Taylor Farms facility is not — note the enlarged processing building, the solar array at left, the formal employee parking, and the trailer yard across the top of the image. Google Earth historical imagery.

Put the two frames side by side and a second argument appears, one that has nothing to do with the balneario. The bathing complex in 2023 looks much as it did in 2010. The Taylor Farms facility does not. The 2010 image shows a moderate plant: one main building, blue-roofed outbuildings, a large unpaved graded area to the north. The 2023 image shows a substantially larger processing building, a solar array along the western boundary, hundreds of employee vehicles in formal parking rows, and a trailer yard holding well over a hundred units. That is not incremental growth. That is a different scale of operation — more throughput, more wash water, more workers, more waste.

One more feature is visible in both frames and deserves attention from someone qualified to identify it. A linear channel runs east to west immediately north of the highway, between the plant and the balneario, and appears to hold water in both images. The 2023 frame also shows a standing water body along that channel southwest of the plant. If that is an irrigation canal or a drainage ditch, it is a surface pathway between the two properties — and surface connection is far easier to establish than aquifer connection. It would also have been visible from the plant yard in 2013. Separately, the 2010 frame shows a dark oval pond immediately southwest of the main building that I cannot find in the 2023 frame. If that was a retention or process-water lagoon, its disappearance during the expansion is a records question worth asking.

Cyclospora cayetanensis has no animal reservoir. Cattle do not carry it, wildlife does not carry it, birds do not carry it. It completes its life cycle in human beings and nowhere else. Every oocyst that ends up on a leaf of iceberg lettuce came out of a person. With E. coli O157:H7 you go looking for a feedlot upgradient of the field. With Cyclospora you go looking for human sewage.

Cyclospora Oocysts are shed unsporulated and non-infectious. They must sit in the environment for roughly one to two weeks at temperatures between about 22 and 32 degrees Celsius before they can infect anyone, which is why CDC says direct person-to-person transmission is unlikely. A sick person cannot hand this parasite to the person beside them. What that person can do is deposit inert oocysts into soil or water, walk away, and leave them to ripen. And northeastern Guanajuato is close to ideal for that ripening: mean daily maximum temperatures at San José Iturbide run from about 23 to 31 degrees Celsius across the entire year, sitting inside the sporulation window in every month.

I want to be careful here, because there is a version of this argument that is wrong. On July 15 the International Fresh Produce Association faulted Michigan’s health department for saying recreational water is not a recognized risk factor, cited three papers for the proposition, and told The Packer that Michigan was defying reputable science. Its consumer FAQ still tells readers that pool chlorine will not kill Cyclospora and that people who swallow pool water are not protected the way they would be from other waterborne illnesses. County health departments in Ohio and Arizona have said much the same thing. The implication running through all of it is that swimmers are catching this. They are not.

The most recent global review of waterborne protozoan outbreaks, published by Bourli and colleagues in the Journal of Water and Health in 2023 and the fifth in a series running since 2007, catalogued 416 outbreaks worldwide between 2017 and 2022. Recreational water and swimming pools were the suspected source in 313 of them — three quarters of the total — and 92 percent of those were Cryptosporidium. Cyclospora caused three outbreaks in the entire six-year window, and the review lists each one by name: drinking water in Poland traced to travelers from Indonesia, drinking water in South Korea traced to travelers who drank at a church in Nepal, and a British cluster among travelers returning from Mexico whose recorded exposures were fruit, salad vegetables, fresh herbs, bottled water and ice. Not one of them is a pool. Cryptosporidium owns that category, because Cryptosporidium is infectious the moment it leaves the body. Cyclospora is not. A health department urging caution about pools is being careful. A trade association telling you recreational water is a live risk factor in this outbreak is doing something else. It is moving the story off lettuce.

The defensible argument is not that the balneario infected swimmers. It is that the balneario is a fecal loading point into the environmental water system surrounding a ready-to-eat produce plant. And that mechanism is not my invention. It is the express premise of the research the produce industry has been funding for a decade.

The Center for Produce Safety states plainly that it has invested 1.6 million dollars in Cyclospora research since 2014, and that the results confirmed the parasite is endemic in the United States and can be recovered from wastewater and irrigation water, which it calls a significant risk for produce contamination. That is the industry’s own research arm saying the parasite lives in sewage and reaches crops through water. Go one level down and the mechanism gets named outright: a CPS and USDA-listed project led by Charles Gerba, Kelly Bright, Paula Rivadeneira and Walter Betancourt at Arizona was built to determine whether American produce is at risk from irrigation water contaminated by human sewage, and it specifies the sources — faulty and leaking septic systems, compromised sewer pipes, and treated wastewater effluent discharged into surface waters used to irrigate food crops. The USDA National Agricultural Library listing carries the identical framing. Faulty septic near produce ground is not a theory I am floating. It is a funded federal research question.

The surveillance results tell you where the parasite actually is. A two-year study in a Southeastern Georgia growing region, published in the Journal of Food Protection and funded through CPS, sampled municipal wastewater sludge, on-farm portable toilets, irrigation pond water and spent packinghouse dump tank water. The parasite lives in human sewage, reliably. And an unconfirmed molecular positive on agricultural water is a known published artifact — precisely what happened at the border in July, and why that false positive proved nothing about whether the lettuce was contaminated.

Treatment does not solve it. Kitajima, Haramoto, Iker and Gerba sampled two Arizona wastewater treatment plantsmonthly for a year, detected Cyclospora in wastewater with a purpose-built assay, and concluded that conventional treatment is limited in its ability to remove protozoan oocysts and cysts. That is a functioning municipal plant. A rural recreational facility is not going to do better. Nor is any of this new: Sterling and Ortega reported in Emerging Infectious Diseases that Cyclospora oocysts were recovered from sewage lagoons beside an endemic area of Lima, and that water from those lagoons irrigates pasture, corn, and elsewhere in the city, vegetable crops. That was 1999.

Straight-line distances computed from published coordinates. The processing plant is at 21.10634° N, 100.45266° W.

Taylor Farms will argue it cannot control what its neighbors put into the ground. That argument fails on the 2013 record. FDA told Taylor Farm, in writing, to determine whether Cyclospora is a reasonably likely hazard in this growing region, and if it is, to re-evaluate the wash step. A hazard analysis worth the paper it is printed on would have identified a public bathing complex eight hundred feet from the intake — a bathing complex that the satellite record now proves was sitting there, pools filled, three years before the inspectors arrived. The failure here is not that the balneario is there. The failure is that the federal government said look, and thirteen years and one record-breaking outbreak later, no one can show that anybody did.

Mexico’s health secretary, David Kershenobich, told reporters Tuesday that his government has found no evidence that the outbreak sickening thousands of Americans began on a lettuce farm in Guanajuato. He said Mexico is taking precautions anyway, and its food-safety agencies, Cofepris and Senasica, say they are running preventive inspections and traceability checks in the state. It is a careful statement, and a defensible one on its own terms. It is also the newest verse in a song that has played for two weeks: Taylor Farms says it was less than one percent of the iceberg supply, the produce trade groups say the case rests on interviews, and now a national government says no laboratory result points its way. Every one of them is standing on the same fact — that no sample of the lettuce has tested positive for the parasite. For this parasite, that fact means almost nothing.

Here is why. Cyclospora cannot be grown in a laboratory — there is no culture, no animal model, no way to multiply it and confirm it the way a lab confirms Salmonella or E. coli. Detecting it means finding its DNA on the produce itself, and the produce is lettuce: it is eaten or thrown away within days, while the people who ate it do not fall sick for a week and are not counted for a month or more. By the time investigators know an outbreak exists, the lots that caused it are gone. Contamination is patchy, too — a clean twenty-five-gram sample says nothing about the leaf beside it. So, a negative test is not evidence of a safe field. It is evidence that the evidence was eaten. The one positive sample the FDA did announce, from Taylor Farms de Mexico lettuce, it retracted two days later as a false positive. The absence that remains is not exoneration. It is the ordinary condition of a Cyclospora investigation.

What investigators have instead is the thing that actually breaks these outbreaks open: sick people and a supply chain. Sixteen hundred and forty-four of them. That is how many people across five states — Indiana, Kentucky, Michigan, Ohio and West Virginia — caught Cyclospora after eating at Taco Bell, with illnesses starting between May 13 and July 13 and ninety-four of them hospitalized. Sixteen hundred strangers in five states do not share a rare parasite by coincidence. They shared a restaurant. Michigan interviewed one hundred ninety of its Taco Bell patients, and ninety percent had eaten the iceberg lettuce; the FDA then traced that lettuce back through the chain, and it converged on one supplier — Taylor Farms de Mexico, in central Mexico. That is the evidence, and it is the part the minister’s statement steps around. A positive lab sample would be welcome, but it is not required and never has been. As NBC noted this week, a positive test is not necessarily needed to name a source. What names it here is 1,644 people and one farm at the end of every thread.

And 2013 is the part the statement left out. The same Guanajuato facility — Taylor Farms de Mexico — was the source of a Cyclospora outbreak that sickened more than six hundred people across twenty-five states, traced to salad mix served at Olive Garden and Red Lobster. There was a no-evidence-yet posture then, too, and stepped-up border screening, and a company that pulled far more product than the implicated lot. No one wanted to be the answer. Eleven years later the answer was the same place.

The count is not waiting for anyone’s certainty. CDC now reports 4,173 laboratory-confirmed domestic cases since May 1 and says it is aware of more than 7,400 additional cases not yet confirmed — many of them in Michigan and Ohio — for a national total above eleven thousand five hundred across forty-one states, with three hundred and eight people hospitalized. Michigan alone reported 7,171 cases on Wednesday, up six hundred in a single day. The states themselves add up to a little more; below is where each one stands tonight, with the source for every number.

A word on the counts. Where a state publishes its own figure I used it, because state health departments are closer to the illnesses and update more often; where CDC’s own state table differs materially, I noted both. Update cadence is uneven — Michigan and Indiana post daily on weekdays, West Virginia Tuesdays and Fridays, Ohio and Kentucky weekly — so any national total is a blend of numbers of different ages, and sixteen states publish no 2026 count at all. The roughly 11,350 these fifty numbers add to is a floor, not a ceiling.

So, Mexico is right that there is no laboratory evidence its lettuce made anyone sick. It is right the way a supplier is right when it points to a clean test, and the way a trade group is right when it says the case rests on interviews. In a Cyclospora outbreak the laboratory almost never arrives in time, and everyone who has worked one of these knows it. The evidence here is sixteen hundred people who ate at the same restaurant, thousands more who are sick, and a paper trail that keeps arriving at the same farm in Guanajuato — the same farm as 2013. I have been doing this since 1993, and I have never once watched a positive lettuce sample rescue anyone. The people are the evidence. They always were.

Nearly twelve thousand cyclosporiasis cases have now been reported to the CDC this summer — 4,173 confirmed in the laboratory as domestically acquired, and more than 7,400 more still awaiting the analysis that would confirm them, many of them in Michigan and Ohio. Michigan alone counted 6,571 as of July 21, with 102 hospitalizations and, so far, no deaths. Officials call it likely the largest outbreak of this parasite in the country’s history. As the count climbed, every corner of the produce and grocery world that speaks for itself put out a statement. Some of those statements have quietly changed since. Here is the whole map, group by group, with links so you can read each one yourself and check my work.

Start with the group that comes out of this best. The International Fresh Produce Association — the trade body that speaks for the whole supply chain — put out a sharp statement on July 15 through its chief science officer, Max Teplitski. Its core claim was that a survey of what sick people remembered eating, without a contaminated sample to match it, is a lead and not proof. I have spent thirty years arguing the other side of that in court, and I still think the epidemiology here is strong. But IFPA did something the others did not. When it softened the statement on July 19 — dropping the tougher lines about Michigan and about jobs — it left the original sitting right there on the same page, dated and signed, beneath the new version. You can read both at once. That is what a correction is supposed to look like.

Now the one that troubles me. The California and Arizona Leafy Greens Marketing Agreement, which speaks for the lettuce farms, also posted on July 15. That first version called lettuce a leading suspect, argued that Cyclospora has historically been tied to imported produce rather than domestic greens, and — to its credit — noted plainly that CDC had cut national Cyclospora surveillance in 2025 after federal budget reductions. That last point is mine too; it is the whole reason we cannot count this outbreak. The next day the page was replaced under a different byline with a warmer, more sympathetic message, and both of those lines were gone. The tone improved. But the original now survives only on the Wayback Machine. A statement you have to dig out of an internet archive is not a statement the public can still hold you to.

LGMA’s newest word came in a July 20 webinar with food-safety scientist Jennifer McEntire, formerly of IFPA. Her headline was blunt and, on the science, correct: “testing is not the answer.” Current methods for finding this parasite on a leaf are too unreliable to lean on. She is right that you cannot test your way to prevention. I would only add the other half of that truth: you cannot test your way to innocence either. When a supplier waves a clean sample, remember that a negative result on a parasite this hard to detect proves almost nothing — which is exactly why the people who ate the lettuce, not the lab, are the evidence in an outbreak like this.

FMI, the grocery-industry association, wrote the clearest consumer material of anyone. It confirms the recall, links the federal notices, and states the gap between confirmed and probable cases honestly. I will praise it without hedging — and then note the thing that sits awkwardly beside the praise. FMI has been the most forceful voice in the country for delaying the food traceability rule that would make outbreaks like this traceable in the first place. Both things are true at once, and readers deserve to know both.

The National Grocers Association broke a longer silence with practical guidance for independent stores. It is useful, with one real problem: it tells grocers to reassure customers that there is no broad retail recall. There is one. The recall reached bagged Marketside iceberg and shredded lettuce on Walmart shelves in more than a dozen states, and federal officials are telling shoppers to throw it out. NGA also applauded the thirty-month delay of the traceability rule as too hard on smaller grocers. I understand the burden; I would ask them to weigh it against the count in Michigan.

Give Western Growers credit for the most serious piece of thinking from inside the industry. Joelle Mosso named three gaps — risk communication, national surveillance, and the way the country handles imported risk. I wrote back to say she is right on two of the three. On surveillance and on imports she is closer to the mark than most of the public-health commentary I have read this month. Where we part is her call for quieter, more careful warnings; the cure for a vague warning is a faster, more specific one, and that requires traceability, not restraint.

And then the silences. The National Restaurant Association has said nothing about an outbreak that ran through a fast-food chain, even as reporters asked. The Fresh Produce Association of the Americas, which speaks for importers of exactly this kind of Mexican produce, has said nothing either. The silence is more glaring because Taco Bell — an operator, not a trade group, and the one with the most to lose from talking — pulled the lettuce and said so twice, ahead of the federal advisory. When the restaurant on the corner outruns the associations built to speak for the industry, the associations should notice.

So far this is a story about the groups that speak for the industry. But the company at the center of the outbreak has been speaking for itself, too — and it has done the quiet-edit trick more brazenly than any association here. The credit for catching it belongs to Bloomberg’s Jessica Nix and Kristina Peterson, who on July 21 lined up the dates and called what they found a slow-walk. The recall window ran June 29 to July 16 — weeks after the first illnesses began in mid-May. By the time Taylor Farms’ lettuce came off the shelf, the contaminated product had already been eaten.

Watch the statement itself. Taylor Farms’ first version, on July 17, opened with concern for the sick and — this is the sentence that matters — acknowledged that FDA’s traceback pointed to a specific central-Mexico farm, which it called less than one percent of the U.S. iceberg supply, and said it had pulled all of the region’s iceberg. Over the next forty-eight hours the company rewrote that statement at the same web address, with no version note. The sympathy slid from the first paragraph to the fourth. A grievance against FDA rose to the lead. And the acknowledgment that the traceback pointed at its own farm simply vanished. It is the same edit-in-the-dark I faulted LGMA for above, performed by the company with the most to lose.

That vanished sentence may be the most important one in the whole outbreak, and here is why. Taylor Farms wrote it on July 17 — before any product sample was ever reported positive. It is the company’s own admission, in its own words, that the recall rested on FDA’s traceback and the epidemiology, not on a lab result. Which is why the false positive the company spent the following Sunday turning into a demand for an apology changes nothing. In a Cyclospora outbreak the victims ate the evidence months ago; a clean sample proves nothing, and Taylor Farms had already conceded as much in writing before the sample existed.

And none of it happened in a vacuum. The New York Times reported, and a Taylor Farms spokeswoman confirmed, that on July 16 — the day before the recall — company executives met with White House and FDA officials to complain about what they called shortfalls in the agencies’ outbreak response, challenged the finding that their lettuce was responsible, and worked to distance the company from the illnesses — while conceding they had only been contacted in the days just before the recall, after investigators had been chasing this outbreak for weeks. The Times also reported the company had been staffing up in Washington, hiring a former Trump White House personnel official. Then, on July 20, FDA answered in public: the false positive does not change the overwhelming epidemiological data, and the traceback continues to converge on Taylor Farms locations — plural — in central Mexico, not the single small farm the company had named on July 17 and unnamed by July 19.

Step back, and every one of these statements is circling the same hole. No one — not the growers, not the grocers, not the agencies — can catch a contaminated leaf before it ships, count the people it sickens, or trace it back to the field fast enough to matter. That is not bad luck. Over the last fifteen years this country took apart the three tools built to do exactly those things, one after another, and this outbreak walked straight through the space where they used to be.

Start with the one almost no one remembers. For a decade the U.S. Department of Agriculture ran the Microbiological Data Program — the MDP — which did the single thing none of the systems above can do now: it went out and tested the produce itself. From 2001 to 2012, on a budget of about five million dollars a year, it pulled more than 120,000 samples of high-risk fruits and vegetables off shelves across 42 states, screened them for pathogens, and when it found one it told FDA, CDC and the states right away. In 2010 and 2011 alone its findings drove twenty-three produce recalls, fifteen of them tied to real human illness. It was, in plain terms, the country’s early-warning radar for contaminated produce — the one program that looked at the lettuce instead of waiting for the patients.

Then it was gone. The program was zeroed out in the Obama administration’s 2013 budget, defended by USDA as work that fell outside its marketing agency’s mission, over the objection of Congresswoman Rosa DeLauro. And Food Safety News reported at the time that the produce industry’s own paid lobbyists had pushed to end it — the trade group leading that effort was United Fresh, which in 2022 merged into the International Fresh Produce Association. The same house that helped switch off the radar is the one now, in this outbreak, calling for surveillance to be rebuilt. I do not raise that to score a point. I raise it because IFPA is right that we need it back, and it is better positioned than anyone to help undo what its predecessor helped do. Bring the MDP back, or something like it, and someone is once again testing the produce before it reaches a taco.

The second tool went dark just last year, and it is the reason you keep seeing two different numbers for this outbreak. On July 1, 2025, the CDC cut its foodborne-illness surveillance network, FoodNet, from eight pathogens down to two — it kept Salmonella and E. coli and made Cyclospora, along with Campylobacter, Listeria and three others, optional to report. The agency’s own explanation was money: the funding had not kept up. That is why Michigan alone now counts more cases than the CDC has laboratory-confirmed in the entire country, and why the states’ tallies and the federal one keep telling two different stories. We are living through an outbreak the national system is no longer built to count. And here let me be just as fair in the other direction: you cannot lay FoodNet at the produce industry’s feet. No lobbyist killed it. It was a budget decision at CDC, made under a different administration than the one that ended the MDP — which is exactly the point. Across fifteen years and both parties, foodborne-disease surveillance has been treated as the easy thing to cut. Fixing FoodNet — restoring the full list of pathogens and the money underneath it — is the fastest way to at least see clearly the outbreak we are already in.

The third tool is the one still salvageable, because it wasn’t killed — only shelved. FSMA Section 204, the Food Traceability Rule, puts leafy greens on a list and requires lot-level records a company must hand over electronically within twenty-four hours. It was supposed to take effect this past January. It now sits with a 2028 date on it, pushed there with the produce and grocery industry’s blessing.

The sharpest proof of what that last rule would buy came from IFPA’s own scientist. Asked by The Packer on July 15 how full traceability would have changed this outbreak, Teplitski reached for the cilantro that investigators had wrongly floated before the Fourth of July. With the rule in force, he said, you could establish in an afternoon whether a given lot of cilantro went into a given salsa, which kitchen received it, when, and where else it traveled — then line that up against the map of who got sick and rule cilantro out fast.

The rule, he said, “would’ve helped to eliminate cilantro as a suspect within hours.”

Read that again, because it is the whole argument in one sentence. Teplitski wants the traceability rule so the industry can clear an innocent product in hours. I want the same rule so investigators can name a guilty one in hours. It is the same twenty-four-hour records requirement doing both jobs — and his industry lobbied to delay it to 2028. On the science of this parasite, IFPA has been the most honest voice in the room. The next honest thing it could do is spend its considerable weight in Washington getting the one rule that would end the guessing put back on the calendar. I would stand with them if they did.

Catch it, count it, trace it. The Microbiological Data Program could have caught this lettuce. FoodNet could have counted the sick. The Traceability Rule could have found the field. We dismantled the first, defunded the second, and delayed the third — and then acted surprised at an outbreak from a source no one can name. Two of those three failures the produce industry had a hand in. The honest response now is not to relitigate the blame but to put all three tools back, and the industry groups in the table above are the ones with the weight in Washington to do it.

Until then, the count in Michigan climbs by the hundreds each morning, the source of most of those cases is still officially unnamed, and the industry’s statements about it are, in a couple of cases, no longer the statements it first wrote. I have tried to keep this record straight and fair, and to hold myself to the same standard I am asking of everyone else: when the facts move, you correct in the open and you leave the original where people can find it.

The Secretary of Health and Human Services said today that this outbreak is “under control.” I would like that to be true. Here is what the states reported while he was saying it.

Michigan added 2,408 new cases in the week ending July 18. The three weeks before that were 71, then 498, then 1,331. That is not a curve bending down. That is a curve that has doubled in each of the last three weeks, and Michigan’s own total went from 6,148 on Monday to 6,571 today, with 23 more out-of-state cases waiting to be referred somewhere else. West Virginia went from 69 cases on July 13 to 195 today, with 15 hospitalized — nearly triple in eight days. CNN put it plainly this afternoon: the epidemiological curve has not yet slowed.

An outbreak is under control when new cases stop appearing. Not when a recall is issued. A recall is an action taken; control is a result observed. The Secretary described the first and called it the second.

There is a second problem with today’s statement. He said the source has been identified, citing extensive forensics. But FDA spent Sunday night withdrawing the only positive lettuce sample it had as a false positive. The traceback still points at Taylor Farms de Mexico, and FDA is right about that. But there is a difference between an epidemiological conclusion and a confirmed source, and the government is now claiming the second while holding the first. That is exactly the kind of overstatement that gets thrown back at investigators later.

He also said the criticism about surveillance cuts is invalid, and that FoodNet reductions were only for redundant surveillance. CDC made Cyclospora reporting optional in 2025. Six of the eight pathogens came off mandatory reporting. Whether you call that redundant depends on whether you ever intended to count this parasite. We are now two and a half months into a season in which nobody can say how many people are sick, and the Secretary’s own department publishes three different numbers.

Those numbers are worth laying out, because they are the heart of it. CDC’s outbreak investigation page says 1,644 people who reported eating at Taco Bell have been reported by five states, with 94 hospitalizations and illness onsets running from May 13 through July 13. CDC’s health advisory separately says 1,645 lab-confirmed domestically acquired cases across 34 states, with 141 hospitalizations. And CDC’s surveillance page says it is aware of more than 5,100 additional cases awaiting analysis, plus another 440 travel-associated cases. Meanwhile FDA’s outbreak table carries the iceberg lettuce cluster at 1,644 and four other open Cyclospora investigations alongside it.

Add up what the fifty states themselves are reporting and you get roughly 10,750. CDC concedes the point in its own words: it is aware that states are likely to report higher counts than its data reflects. The federal number is not wrong. It is just months behind, and it is the number the Secretary used to tell the country this is handled.

One more thing, and it is not a small one. Ohio’s health department reports 1,316 cases statewide as of July 16. The Toledo-Lucas County dashboard, covering only the northwest corner of that state, reports 2,029. A region inside Ohio is reporting more cases than Ohio. Both numbers are real; they come from different reporting systems that count different things on different days. That is the condition of American foodborne disease surveillance in the middle of the largest cyclosporiasis outbreak this country has ever had. Under control is not the phrase I would use.

Below is where all fifty states stand tonight, with the source for every number.

A word on the counts. Where a state publishes its own figure, I used it, because state health departments are closer to the illnesses and update more often. Where CDC’s own state table differs materially, I noted both — and it cuts in both directions. CDC lists more cases than the state does in New York, Colorado, California, Georgia and Virginia, and far fewer in Illinois. Nobody’s numbers agree with anybody’s.

Update cadence matters too, and it is uneven. Michigan and Indiana post daily on weekdays. West Virginia updates Tuesdays and Fridays. Ohio and Kentucky update weekly. CDC’s national figures have not moved since July 13. So any national total, including mine, is a blend of numbers of different ages. Sixteen states still publish no 2026 count at all.

Roughly 10,750 is a floor, not a ceiling. It mixes domestic and travel-associated illness in the states that do not separate them, it counts only people sick enough to see a doctor who ordered the specific test that finds this parasite, and it omits sixteen states entirely. CDC says the true number is likely higher. On that, the Secretary and I and CDC all agree.