We spend a great deal of energy in this country worrying about imported food. FSMA gave FDA the Foreign Supplier Verification Program, which makes the American importer responsible for confirming that a foreign supplier produces food in a way that meets our standards. We keep import alerts. We detain shipments without physical examination. The premise behind all of it is that food grown somewhere else deserves an extra look before it reaches an American table.

Canada applies that same premise to us, and the commodity it applies it to is romaine lettuce grown in California.

What Canada requires

The Canadian Food Inspection Agency maintains a page titled Temporary import requirements for romaine lettuce from the United States. The 2026 edition takes effect September 24 and runs through December 17. The conditions are imposed under section 20(3) of the Safe Food for Canadians Act, which allows the Minister to attach conditions to a licence.

The reason is stated plainly at the top of the page. Romaine imported from the United States has been associated with several E. coli O157:H7 outbreaks in Canada and the United States, and American investigations have identified a recurring geographic source: the Salinas Valley counties of Santa Cruz, Santa Clara, San Benito and Monterey.

If the lettuce comes from anywhere else in the United States, the importer must hold a proof of origin, meaning a signed and dated letter on the exporter’s letterhead naming the state and county of harvest. If it comes from those four counties, or if no proof of origin exists, the importer has to do more.

This is the seventh consecutive fall. The first round ran October 7 through December 31, 2020, and CFIA has renewed the conditions every harvest season since.

Why Canada did it in the first place

Canadians were among the sick.

In the 2017 outbreak, the Public Health Agency of Canada counted 42 cases across five eastern provinces, 17 hospitalizations and one death. Romaine was identified as the source. The cause of the contamination never was.

In the spring 2018 Yuma outbreak, eight Canadian illnesses were genetically similar to the American cases, reported from British Columbia to Quebec.

In the fall 2018 outbreak, FDA traced the lettuce to the Central Coast growing regions of northern and central California. PHAC noted that romaine grown in Canada, including hydroponic and greenhouse romaine, was not involved. CFIA imposed import controls during that outbreak and said it was reviewing control measures going forward. The seasonal rule is what came out of that review.

What changed for 2026

Until this year, a shipment from those four counties needed an attestation form and a Certificate of Analysis for every consignment, uploaded at the time of the import declaration. The testing protocol is not casual: 60 individual random sample units of 25 grams each, 1,500 grams per sampling lot, analyzed by a laboratory accredited to ISO/IEC 17025, with a presumptive positive treated as a positive unless confirmed negative within 24 hours.

Three things changed. The attestation form is gone. Supporting documents no longer have to be uploaded with the import declaration, and importers simply retain them and produce them if CFIA asks. And there is now an alternative to lot-by-lot testing.

An importer may instead obtain a letter confirming that the LGMA member supplying the lettuce participates in the California LGMA Romaine Test & Learn Program. The letter needs the member’s name, a date, a statement of participation, and a signature. CFIA says it may be obtained once at the beginning of the import period.

A season of shipments can now ride on one signed letter that nobody looks at unless something goes wrong.

CFIA gives its reason: the absence of reported E. coli O157:H7 outbreaks linked to romaine lettuce in recent years, together with strengthened control measures for Salinas Valley romaine.

The timing

That page was last modified July 23, 2026.

On September 10, 2026, FDA closed CORE investigation #1382 and named romaine lettuce as the vehicle in a 14-case E. coli O157:H7 outbreak. FDA had carried that file since July 1 with no food identified, and it identified one on the way out the door, with no grower and no processor named. I wrote about it yesterday.

CFIA’s stated premise for relaxing its rule was published six weeks before FDA acknowledged a 2026 romaine O157:H7 outbreak, and the season that rule governs had not yet begun when FDA acknowledged it.

I do not fault CFIA for failing to know in July what FDA would publish in September. That is the problem, not the excuse. A foreign regulator calibrating its controls on American lettuce can only work from what our agency publishes, and our agency published nothing until the file was closed.

What a participation letter is, and what it is not

Test & Learn is a good idea. LGMA launched it in July 2023 as a two-year study, folded it into the required food safety standards that September with audits starting in January 2024, and in August 2025 extended data collection through September 30, 2027 while adding a root cause interview for any member that submits a positive sample. Members’ pre-harvest and finished-product results are aggregated on Western Growers’ GreenLink platform. The model was borrowed, deliberately, from aviation safety data sharing.

But it is a data collection and analysis program. It is not a release test for a truckload. A letter confirming that a handler participates tells an importer something about the supplier’s program. It tells the importer nothing about the lettuce in the trailer. That is the trade CFIA made, and it made it with its eyes open, since the page lays both options out side by side.

A caution for Ottawa

There is one more thing the Canadians should hear, and I offer it as a friend of the rule they just relaxed.

CFIA’s stated reason was the absence of reported E. coli O157:H7 outbreaks linked to romaine lettuce in recent years. Read that sentence again, and put the weight where it belongs. Reported.

In November 2024, while CFIA’s temporary conditions were in force for that season, an E. coli O157:H7 outbreak tied to romaine lettuce sickened 89 people in 15 states. Thirty-six were hospitalized. Seven developed hemolytic uremic syndrome. One person died. FDA issued no public announcement while it was happening. Its first public mention of the outbreak was a line on the CORE table after the investigation was closed.

I spent the year after that prying the traceback summary loose. When the redactions finally came off, the file led to a single processor, Taylor Farms of California in Salinas, and a single grower, Anthony Costa & Sons in Soledad, which sits in Monterey County, one of the four counties on CFIA’s own list. Taylor Farms has denied that its product was the source. The documents are here.

Now put #1382 next to it. FDA posted that file on July 1, 2026 with no food identified, carried it that way for ten weeks, and named romaine on September 10 as it closed. Measured by CFIA’s test, there was no reported American romaine outbreak this summer, right up to the day there was, seven weeks after CFIA published its rationale.

A regulator in Ottawa scanning for reported American romaine outbreaks is scanning a feed whose contents FDA decides. The absence of reported outbreaks is not the same thing as the absence of outbreaks. It can just as easily be the absence of reporting.

The part that should sting

Set what the Canadian system asks of us against what our own system delivered this summer.

A Canadian importer has to be able to produce a document naming the state and the county where the lettuce was harvested. FDA closed a romaine outbreak without naming a grower, a processor, a county or a brand.

Canada tells its importers exactly which four California counties are the recurring problem. FDA’s handling of #1382 told American consumers nothing of the kind, and told them nothing at all until the investigation was over.

We ask the rest of the world to verify its suppliers before food crosses our border. A neighbor asks the same thing of us, and our answer this fall is a letter obtained once in September saying the grower is enrolled in a program.

I have been suing lettuce companies for nearly thirty years. The counties have not changed. The pathogen has not changed. What changes is how much the public gets told, and when.

If Canada wants to know whether the lighter touch was the right call, the thing to watch is not whether FDA announces a romaine outbreak. It is what shows up on the CORE table after the file is closed.

In July I wrote that I had bought Congress a t-shirt — one for every member. The shirts arrived in August. This month they are being hand-delivered, and I have narrowed the aim.

Seventy-seven offices are getting two shirts each, carried in by hand: all 54 members of the House Energy and Commerce Committee and all 23 members of the Senate Committee on Health, Education, Labor, and Pensions. Those are the two committees with jurisdiction over the FDA, and between them they hold every procedural key to the only bill that would fix this. Everyone else in Congress still gets one. These offices get two, and they get a person at the counter rather than a package on a mail cart.

The timing is deliberate. The House came back for a single week on August 31 and went home again for Labor Day. The Senate has been out since the first week of August. Both chambers return Monday, September 14. The shirts land in the week they walk back in.

I have written each of those committees twice. Energy and Commerce got a letter on June 23 supporting H.R. 7867, with the statements and photographs of fourteen families attached, and a follow-up on August 28. HELP got a letter on June 29 and a follow-up on August 28. Four letters. No reply to any of them. I have also written Secretary Kennedy, and when Chairman Cassidy demanded answers from Nara and ByHeart I gave him full credit for it in public. None of it has produced a markup.

What changed between the first letters and the second ones is that the argument stopped being an argument. On August 27 the CDC closed the Nara Organics investigation and did it without a hedge, finding that the formula was contaminated with Clostridium botulinum and made infants sick — where its earlier update had said only that the formula might be contaminated. Then came the part that should have moved the calendar. Whole genome sequencing linked a patient sample from the Nara outbreak to a patient sample, product samples and an ingredient sample collected during the 2025 ByHeart investigation. The same organism, in a baby fed one brand and, in the product, and the ingredient of the other.

In June I told both committees that the contamination had not struck two unrelated companies by chance, that it had traveled through one shared supply stream the system missed twice. That was reasoning from a traceback and a trade-press report. It is no longer reasoning. A strain does not move between two babies who never drank the same product by accident. It moves through the thing they shared, and the only thing these two shared was an ingredient — milk supplied by Organic West Milk, spray-dried by Dairy Farmers of America.

Forty-eight infants in the ByHeart outbreak, across seventeen states, the largest infant botulism outbreak in American history. Four in the Nara outbreak, in California, Pennsylvania and Washington, with onsets between April 20 and May 31 of this year. Fifty-two babies hospitalized, many of them on ventilators, each one treated with BabyBIG antitoxin that the State of California prices at $69,300 a dose.

And the rule has not moved an inch. Federal regulation still requires powdered infant formula manufacturers to test finished product for exactly two organisms — Salmonella and Cronobacter. That is 21 C.F.R. § 106.55, and C. botulinum is not on it. It was not on it in November 2025. It was not on it this spring. It is not on it this morning. The FDA named the organism itself, by genus and species, in a March 8, 2023 Call-to-Action letter to the entire powdered formula industry — three and a half years ago, and more than two years before the first ByHeart baby got sick. The hazard was on the government’s own record. The rule never caught up to it.

H.R. 7867 fixes the part a statute can fix. It puts C. botulinum on the required testing list, mandates environmental monitoring inside the plants where this powder is made and holds foreign manufacturers to American standards. It is bipartisan. The Health Subcommittee held its hearing on April 29. It has sat in Energy and Commerce ever since, waiting on a markup nobody has scheduled. The Senate passed S. 272 the same day that hearing happened — 22 to 0 in committee, unanimous consent on the floor — which tells you this is not a hard vote once somebody puts it on the calendar. S. 272 is the narrower bill. It reaches the organisms already on the list and does not reach the one that paralyzed these fifty-two children.

So, the shirts go with four asks, the same four in both buildings. Mark up H.R. 7867 and report it favorably. Hold the oversight hearing, with the FDA, Dairy Farmers of America, Organic West Milk, Nara Organics and ByHeart at the table, because the questions are sharper now that there is a laboratory result to ask about. Put the parents at the witness table — they have written to you already, and they are willing to come and say it in person. And put a written question to the FDA with a deadline: what has the root cause investigation found, does the agency intend to require this testing by regulation, and if so, when. A date certain would tell you whether legislation is necessary or merely useful. The absence of one would tell you something too.

A t-shirt in a plastic bottle will not produce a markup. But it is small, it is strange, it does not throw away easily, and it says the whole argument in one line. They will be sitting on a desk in Rayburn and in Dirksen next week, in every office that can put this bill on a calendar. Somebody is going to unroll one and read it out loud.

I have been suing companies since 1993, and I would close the doors tomorrow if Congress made this product safe enough that nobody needed me. Fifty-two families already know what the sequencing means. They would like to know that Congress does too.

The four letters

https://www.marlerblog.com/files/2026/08/HR_7867_Support_Letter_6_23_26_WDM_FINAL.pdf

Letter to the House Committee on Energy and Commerce, June 23, 2026, with Appendix A — statements and photographs of fourteen families.

https://www.marlerblog.com/files/2026/08/Marler_Senate_HELP_Letter_Letterhead.pdf

Letter to the Senate Committee on Health, Education, Labor, and Pensions, June 29, 2026.

https://www.marlerblog.com/files/2026/08/HR7867_Follow_Up_Letter_8-28-26.pdf

Follow-up letter to the House Committee on Energy and Commerce, August 28, 2026.

https://www.marlerblog.com/files/2026/08/Senate_HELP_Follow-Up_Letter_8_28_26_WDM.pdf

Follow-up letter to the Senate Committee on Health, Education, Labor, and Pensions, August 28, 2026.

Yes, it is past time for a warning label on sprouts. I first asked FDA for one in 2000. Twenty-six years later nobody has to invent it — the government wrote the template in 1998 and put it on a bottle of unpasteurized apple cider.

I have lost track of the number of “sproutbreaks” over the years. My friends at Barfblog kept a running table of at least 55 sprout outbreaks worldwide and 15,233 people sick since 1988, last updated in 2014. FDA’s own guidance to the sprout seed industry counts 52 American outbreaks since 1996 and more than 2,700 illnesses. Whichever number you prefer, it keeps going up. Two are open as I write this.

ProductGrowerCasesStatesHospitalized
Alfalfa sprouts (Calco, Everything Sprouts)Everything Sprouts, LLC55154
Broccoli sproutsEvergreen Fresh Sprouts, LLC2242

Sources: CDC outbreak pages, updated September 1 and 9, 2026. Washington is on both lists, so the combined footprint is 77 people in 18 states.

The alfalfa outbreak involves Salmonella and three strains of Shiga toxin-producing E. coli, with two people carrying both. The broccoli sprout outbreak is a different grower, state and serotype, and FDA says they are unrelated. Both companies have recalled. Neither package carried a warning before anyone got sick.

The advice is twenty-eight years old, and it has never been on a bag.

FDA first advised high-risk consumers away from raw sprouts on August 31, 1998, and reissued it on July 9, 1999, with Commissioner Jane Henney saying that despite everything the industry had tried, the best way to control the risk was not to eat raw sprouts. FDA broadened it on October 2, 2002 to cover mung bean and lightly cooked sprouts.

CDC said the same thing in its own peer-reviewed journal in 1999: treatments of seed and sprouts cannot remove all the bacteria present, the conditions that germinate a seed are the conditions bacteria like best, and people at high risk should probably not eat raw sprouts at all. The same advice appears on every sprout outbreak page CDC has posted since, including the two open this week.

Twenty-eight years of consistent federal advice, delivered entirely through press releases, talk papers and web pages. A press release has the shelf life of one news cycle. A package sits in a refrigerator until somebody eats what is inside it.

FDA already wrote this label once, for juice, and it took ten weeks.

After the unpasteurized juice outbreaks of the mid-1990s, FDA proposed a warning statement on April 24, 1998, published the final rule on July 8, 1998, and made it effective September 8, 1998, in time for that year’s cider season. The rule sits at 21 CFR 101.17(g), and the required words are these:

WARNING: This product has not been pasteurized and, therefore, may contain harmful bacteria that can cause serious illness in children, the elderly, and persons with weakened immune systems.

FDA was explicit about why it moved that fast. Its own guidance explains that the warning label was meant to provide a measure of public safety until juice HACCP rules could be established and implemented. The label came first. The process rule came later.

Sprouts got that order backwards. The Produce Safety Rule gave sprouts a subpart of their own — seed treatment, testing of spent sprout irrigation water, environmental monitoring for Listeria — with compliance dates running from 2017 through 2019. Sprouts are the only produce commodity in that rule with its own section, because everyone involved agreed sprouts are different. Sprouts got the rule. Sprouts never got the label. And here we are in September 2026 with two outbreaks running at once, one of them from a company FDA had warned sixteen months earlier.

The Food Code already bars sprouts for the vulnerable. It stops at the front door.

This is the part that ought to end the argument. FDA’s Food Code, section 3-801.11(G), says raw seed sprouts may not be served or offered for sale in a ready-to-eat form to a highly susceptible population. That means hospitals, nursing homes, dialysis centers, child and adult day care, assisted living and senior centers. Most states have adopted some version of it.

The finding has already been made, by the federal government, in a model code the states enforce. Raw sprouts are too dangerous to put in front of a frail eighty-five-year-old. She is protected at dinner in the nursing home. She drives herself to the grocery store and buys the identical product with nothing on it at all. Same for the pregnant woman, the toddler and the man in the middle of chemotherapy.

The biggest names in American food already made this call, on their own.

Large retailers and restaurant chains looked at the same facts and quit.

  • Walmart quietly pulled raw sprouts from its U.S. stores and clubs in October 2010, citing “the inherent microbial risks associated with sprouts.”
  • Jason’s Deli dropped them across 230 restaurants in January 2012. Its spokesman told The Packer the chain had “lost confidence in sprouts.” It still names 2012 as the year it dropped sprouts for safety.
  • Erbert and Gerbert’s pulled alfalfa sprouts system-wide in February 2012 and said so in a press release. CEO Eric Wolfe said removing them was how the chain eliminated the risk. It had no problem with its own supply.
  • Kroger, then 2,425 stores in 31 states, stopped on October 22, 2012. Its food safety chief, Payton Pruett, said pathogens may sit inside the seed where processing cannot reach them — the reason CDC gave in 1999 and FDA gives now.

Jimmy John’s is the counterexample, and it matters. The chain announced in February 2012 that clover sprouts were gone permanently. Three months later, at a meeting with FDA, it said it would keep serving sprouts from approved suppliers. More outbreaks followed. A voluntary decision lasts exactly as long as the company wants it to.

Every one of those companies reached a conclusion and acted on it. Not one was required to share it with the shopper. Walmart’s was a quiet one — the customer who stopped finding sprouts was never told why.

What the label should say.

Here is my proposal. It borrows the shape of the juice warning, then says out loud what these infections do to people:

WARNING: Sprouts are a raw agricultural product and may contain harmful bacteria (not limited to E. coliCampylobacterListeria and Salmonella) and have been linked to serious injury and death. Pregnant women, infants, children, the elderly, and persons with lowered resistance to disease (immune compromised) have the highest risk of harm, which includes bloody diarrhea, vomiting, fever, dehydration, Hemolytic Uremic Syndrome, Guillain-Barré Syndrome, Reactive Arthritis, Irritable Bowel Syndrome, miscarriage, or death.

That is longer than the juice warning, deliberately. The juice text tells a shopper there may be bacteria in the bottle. It does not tell her the bacteria can take a child’s kidneys or end a pregnancy. Every consequence on that list is documented in the sprout literature, and I have sat across a table from people living with most of them.

The juice text’s opening line cannot be borrowed. Sprouts are never pasteurized and cannot be, because the heat that kills the bacteria also kills the seed. “Raw agricultural product” is the honest substitute.

If FDA balks at fitting all of that on a five-ounce clamshell, the answer is two placements rather than a weaker warning. The package carries the core statement:

WARNING: Sprouts are a raw product that may contain harmful bacteria, including E. coliSalmonella and Listeria, that can cause serious illness, permanent injury or death in children, the elderly, pregnant women, and persons with weakened immune systems. Bacteria may be inside the seed and cannot be washed off.

A shelf placard at the point of sale carries the full list. The juice rule itself allowed the statement on signs and placards for a period, so that precedent sits in the same rulemaking.

Three questions a rulemaking would have to settle.

Scope: all sprouts, or only the ones normally eaten raw? FDA’s 2002 advisory covered raw and lightly cooked, which suggests all of them. Delivery: a package label handles retail, but what about the deli case and the sandwich counter, where no package exists? Exemption: sprouts cooked through before service should be exempt, the way pasteurized juice is. That gives the industry a path rather than a verdict.

Twenty-eight years of federal advice. Twenty-six years since I first asked for the label. More than fifty American outbreaks. Two open this minute, seventy-seven people sick, six in the hospital. The advice exists. The finding exists. The template exists, and FDA wrote it in ten weeks the last time it decided something mattered. The only piece missing is the sentence on the bag.

Eben-Haezer’s Happy Hens of Ramona, California has posted two new Instagram reels, embedded on its own website as of September 11, 2026, arguing that the Salmonella FDA found in its hen houses does not tie its eggs to anyone’s illness because the match came from “environmental samples—not from the contents of an actual egg.” San Diego County’s count in the Ramona outbreak stands at 23 people sick and seven hospitalized, five of them sickened by the eggs directly, and there is still no recall.

The farm’s two new reels make one argument: no egg was tested.

The first reel, headed “Environmental VS Egg Sampling,” explains that an environmental sample “can come from a surface, piece of equipment, floor, nest boxes, or perch area,” that “bacteria exist naturally in the world around us,” and that “if we are finding bacteria in an environment, this does not automatically mean the food produced there was contaminated.” It ends with the question the farm wants asked: “Was the actual product ever tested?” The second reel takes on the sequencing: “a genetic match is not the same thing as proving where an illness came from. The type of sample matters. In our case, the reported match was from environmental samples—not from the contents of an actual egg.” Its last line is “Similar bacteria ≠ automatically proven source.” Neither reel carries a date on the farm’s page; both appeared there after Wednesday morning.

The County did not report similar bacteria. It reported the outbreak strain, in two of seven houses.

San Diego County’s September 4 release is short and specific. FDA sampled the floors, perch rails and nest boxes of the farm’s hen houses beginning August 17. “Salmonella was found by the FDA in two of seven hen houses tested.” “Genetic testing of the salmonella linked the farm to the strains from ill San Diegans.” The California Department of Public Health “shared the FDA results with the owners of Happy Hens and recommended the farm issue an egg recall voluntarily.” Egg test results were pending. Whole genome sequencing does not find similar bacteria; it finds the same bacteria, and the strain in those two houses is the strain in 23 people. I wrote about that release the day it came out, and about the farm’s first answer, that nobody asked for a recall.

The federal egg rule treats an environmental positive as the trigger, not a footnote.

FDA’s shell egg rule, 21 C.F.R. § 118.6, is built on environmental testing. A producer with 3,000 or more laying hens swabs the poultry house, and when a house tests positive for Salmonella Enteritidis the producer has two choices: divert every egg from that flock to pasteurization, or test the eggs, four times at two-week intervals, 1,000 eggs a test, and divert on the first positive. The rule does not wait for a positive egg before it acts on a positive house. FDA wrote it that way because eggs from an infected flock carry the organism inside the shell at a rate low enough that a laboratory can go through thousands of eggs before it finds one. Environmental testing is the screen because egg testing is a weak one. A farm holding up the absence of a positive egg is holding up the reason the rule exists. Happy Hens’ own website, as quoted by the San Diego Union-Tribune in August, put the flock at 14,000 hens, and a state agriculture spokesperson confirmed to the same paper that FDA inspected the farm.

The farm announced the egg tests itself on August 31. The two weeks are up on Monday.

On August 31 the farm’s own Instagram account said FDA’s additional testing had come back with two samples positive for Salmonella Enteritidis, that product from the “affected sites” was being held, and that 4,000 eggs would be tested over the next two weeks. Four tests of 1,000 eggs is § 118.6 running as written. Two weeks from August 31 is September 14. The reel asking “Was the actual product ever tested?” comes from the account that told its followers the product was being tested, and it does not say what the tests have shown so far. The farm is the party that would know first.

What the reels leave out.

They do not mention that the match was to the outbreak strain. They do not mention that the state recommended a recall on September 4 and that none has been issued. They do not mention 23 sick, seven hospitalized, or the five people the County says were sickened by the eggs themselves, not by the deli’s mayonnaise. They do not mention that the same account announced two Salmonella Enteritidis positives eleven days ago, or the 4,000-egg test it said was underway. They do not mention the County’s instruction to every retail food facility not to use or distribute the eggs associated with the outbreak, or the carton that may still be in somebody’s refrigerator. And they do not mention that on September 8 three lawsuits were filed in San Diego Superior Court on behalf of people who ate the eggs. My firm filed them, and now represents seven people in this outbreak.

What the reel saysWhat the public record saysSource
“the reported match was from environmental samples—not from the contents of an actual egg”FDA found Salmonella in two of seven houses; genetic testing linked the farm to the patient strains; egg results pending; CDPH recommended a recallSan Diego County, Sept. 4
“Was the actual product ever tested?”The farm said 4,000 eggs would be tested over two weeks from Aug. 31, which runs to Sept. 14; no result has been published by the farm or any agencyHappy Hens Instagram, Aug. 31
“Similar bacteria ≠ automatically proven source”A positive house means divert the eggs or test 4,000 of them; the rule acts on the house, not the egg21 C.F.R. § 118.6

Sources: happy-hens.com embedded reels (undated, present Sept. 11, 2026); San Diego County News Center release of Sept. 4, 2026; @trulyhappyhens post of Aug. 31, 2026; eCFR, 21 C.F.R. § 118.6, read Sept. 11, 2026. Check: 4 tests × 1,000 eggs = 4,000 eggs; August 31 + 14 days = September 14; 18 deli cases + 5 egg cases = 23.

Outbreak investigations have never waited for a positive egg.

The Midwest Poultry Services outbreak that CDC declared over on September 3 ended at 134 sick in 18 states. FDA’s environmental samples at that farm matched the outbreak strain, and the company recalled its eggs in July. The evidence in Ramona is the evidence that produced that recall: sick people, a supplier the traceback reached, and the outbreak strain in the houses. The difference is that the company here has decided to argue with it on Instagram, and the agencies that hold the results have let it. The County’s release is the only official word since September 4. CDPH, whose recommendation the farm turned down, has issued no release of its own that I can find.

The reel is right about one thing. The type of sample matters. A swab from a perch rail in a house that carries the outbreak strain, in a flock that laid the eggs the sick people ate, is the sample the federal rule was written around. The farm says eggs from the two positive houses are being held and the rest are still being sold. Nobody outside the farm has said the rest are clean. Twenty-three people, seven of them hospitalized, are waiting on a test the farm says it started two weeks ago.

On September 11, 2026, the Centers for Disease Control and Prevention declared the multistate Cyclospora outbreak linked to Taylor Farms de Mexico iceberg lettuce over. The final count is 12,883 laboratory-confirmed illnesses, 570 hospitalizations and 2 deaths, both in Michigan, across 21 states, with onsets from June 14 through August 17. The Food and Drug Administration says its investigation continues: onsite inspections and sampling at iceberg lettuce growers and the processing facility in Mexico have ended, and the samples are pending analysis.

Cyclosporiasis is the intestinal illness caused by Cyclospora cayetanensis, a microscopic parasite that FDA says is believed to infect only humans and to spread through human fecal matter.

The same day, FDA’s Acting Deputy Commissioner for Food, Donald A. Prater, sent the produce industry a letter about preventing the next one. An outbreak being over is not a problem solved.

CDC’s final data show two states carried two-thirds of the outbreak

Since CDC’s August 27 update, the outbreak grew by 1,425 illnesses and 75 hospitalizations and added a twenty-first state, Virginia. The state-by-state data behind CDC’s outbreak map put 5,762 illnesses in Michigan and 2,871 in Ohio, two of every three people in the outbreak. Add Missouri at 1,071 and Indiana at 870, and four states account for 82 percent.

CDC’s case count map with the September 11 final update.

FDA confirmed distribution of the recalled lettuce in 31 states. Ten of them, including New York and Florida, have no illnesses assigned to the outbreak.

How the 12,883 fits with CDC’s national count of 19,595

CDC also restamped its national case data page on September 11, with figures still as of September 8. It measures something different from the outbreak count.

MeasureOutbreak linked to the lettuceAll cases acquired in the U.S.
Laboratory-confirmed cases12,88319,595
Hospitalizations5701,043
Deaths22
States2149 plus DC
Illness onsetsJune 14 to Aug. 17May 1 to Aug. 30
Data as ofSept. 11, finalSept. 8, still growing

Sources: CDC and FDA outbreak pages and CDC case data page, September 11, 2026.

The outbreak count is closed by decision, not because reporting stopped. CDC will not update the outbreak page again, though cases take about six weeks to reach it and more from this outbreak will be reported. The outbreak holds about two in three of the national confirmed cases, a little over half the hospitalizations and both deaths. The maps cannot be compared state by state: the outbreak total includes visitors who got sick in one of the 21 states, while the national map places everyone in the state where they live.

CDC’s national epidemic curve, all 19,595 confirmed U.S.-acquired cases, data through September 8.

CDC’s national curve, which it publishes as a download, shows how much of the summer the lettuce explains, day by day. Both curves peak on July 10: 1,674 people nationally, 1,214 of them on the outbreak chart. The national curve starts on May 1, six weeks before the outbreak’s first case, and 798 people got sick before June 14. Compared period by period, the outbreak chart holds 51 percent of national onsets from June 14 to 30, 65 percent from July 1 to 16, 29 percent in the two weeks after the recall and 12 percent in August. The outbreak chart covers only 85 percent of outbreak cases, so those shares run low, but even adjusted for that, most people who got sick after the recall are not on it. By June 29, when Monroe County announced its cluster, 4,817 people on the national curve were already sick.

Beyond the 19,595, CDC lists 9,355 confirmed cases still being sorted into domestic or travel-acquired and at least 6,149 that are unconfirmed or awaiting an interview, for 35,099 cases in all, plus 1,997 confirmed cases acquired abroad. The states count more broadly still, as the chart below shows.

National onsets ran to August 30, thirteen days past the outbreak’s last, and 20 people got sick after August 17. About 6,700 confirmed domestic cases have no food named, down from the 8,137 I reported on September 8 only because CDC added 1,425 people to the lettuce outbreak. No other source has been named. CDC says the other clusters are listed on FDA’s investigation table and that it will issue outbreak notices only if a source is found and consumers have an action to take. I will be working with epidemiologists over the coming months on where those people got sick.

Where all fifty states stand, with CDC’s numbers beside each one

The states that publish a number now report 33,742 cases this season. That sits between the 19,595 CDC has confirmed and the 35,099 it knows about, which is about where a count built from the states should land. The gaps between the columns below have ordinary explanations. CDC counts only laboratory-confirmed cases acquired in the United States during the May 1 to August 31 season. States count what their laboratories and providers report, often including probable cases, cases still pending classification and residents infected abroad; Washington’s 76 includes 47 people who traveled to a country where the parasite is endemic. Several states, including Ohio, Iowa, Kansas, Arkansas and Kentucky, count the whole calendar year. The as-of dates run from July 11 to September 8, and eight states publish nothing at all.

CDC’s national case map by state of residence, data through September 8. Michigan is alone in the top range, 4,000 to 6,999; Delaware is the only state at zero.

CDC’s national map places each of the 19,595 confirmed cases in the state where the person lives and publishes only ranges. Set beside the outbreak count, which places people where they were exposed, it lines up almost everywhere. Missouri is the exception. CDC counts 1,071 outbreak illnesses in Missouri but places fewer than 200 confirmed cases of any kind among Missouri residents, while Missouri’s own health department has reported 2,152. It is not timing: CDC’s August 27 outbreak figures already had 1,010 in Missouri. CDC’s own pages suggest two possible reasons, people exposed in Missouri who live in another state and Missouri cases still among the 9,355 awaiting classification, and nothing published says which. That is a question for CDC and Missouri. The same map shows how much illness sits outside the outbreak: Texas and North Carolina each have 500 to 999 confirmed residents and 24 and 3 outbreak cases, and New York, which reports 1,042 cases itself, has at most 499 in CDC’s count and none in the outbreak.

The outbreak column is narrower still: confirmed cases CDC has tied to the lettuce, placed in the state where the person was exposed. Measured against what each state counted, it is 39 percent of Michigan’s total, 41 percent of Indiana’s, 44 percent of Kansas’s and 20 percent of Illinois’s. The two series are built differently, so treat those as rough shares, not rates. North Carolina counts 955 cases and has 3 in the outbreak; its health department says its increase does not appear to be associated with the multistate outbreak, and its patients reported eating parsley and cilantro more often than expected. In Pennsylvania, where CDC says cases are reported voluntarily, CDC’s outbreak count of 271 is higher than the last published figure I could find, 214 from August 11.

State2026 casesAs ofCDC all casesCDC outbreakAll of 2025LettuceTaylor Farms link
Michigan14,718Sep 34000 to 69995,76250YesLinked
Ohio5,452Aug 131000 to 39992,87176YesLinked
Missouri2,152Aug 2350 to 1991,071none reportedYesLinked
Indiana2,104Sep 21000 to 399987027YesLinked
Illinois1,437Aug 181000 to 3999292301YesLinked
New York1,042Sep 8200 to 4990694YesUnknown
North Carolina955Sep 1500 to 9993300YesLinked
Kansas840Early Sep500 to 99937329YesLinked
Kentucky819Aug 12500 to 99936645YesLinked
Oklahoma556Aug 25200 to 49926941YesLinked
Florida450Aug 15200 to 4990210YesUnknown
Iowa327Aug 2050 to 19913864YesLinked
Texas315Aug 11500 to 99924512YesLinked
West Virginia315Sep 4200 to 4991708YesLinked
Arkansas287Aug 2550 to 1998713YesLinked
Wisconsin284Aug 2650 to 199065YesUnknown
Virginia242Aug 3150 to 19912115YesLinked
Nebraska218Aug 6200 to 49920751YesLinked
Pennsylvania214Aug 11200 to 499271not notifiableYesLinked
Colorado178Jul 2350 to 1990205NoUnknown
Massachusetts147Aug 550 to 1991874YesLinked
New Hampshire94Aug 2550 to 199437YesLinked
Alabama85Aug 31 to 49019YesUnknown
Washington76Aug 281 to 490not availableMay haveTravel link
Maryland69Jul 1750 to 1990123YesNo link found
Utah48Aug 41 to 49037NoNo link found
New Jersey46Jul 1150 to 1990180YesUnknown
Tennessee44Jul 1650 to 199738YesLinked
California41Jul 1450 to 1990not availableNoTravel link
Minnesota41Jul 1750 to 1990none reportedNoUnknown
Connecticut35Jul 1750 to 199041YesUnknown
Maine27Aug 71 to 49264YesLinked
Oregon23Jul 241 to 490not availableNoTravel link
Arizona19Jul 171 to 49049NoUnknown
Georgia11Jul 1750 to 1993116YesLinked
Mississippi7Jul 221 to 490not notifiableYesUnknown
Hawaii6Aug 261 to 490not availableNoNo link found
Alaska5Jul 161 to 4906NoUnknown
New Mexico5Jul 241 to 4909NoNo link found
Rhode Island4Jul 171 to 4906May haveNo link found
South Dakota3Jul 161 to 4903May haveUnknown
Louisiana1Jul 1750 to 199099YesUnknown
Delawareno count001May haveUnknown
Idahono count1 to 490not notifiableNoUnknown
Montanano count1 to 4908NoUnknown
Nevadano count1 to 490not notifiableNoUnknown
North Dakotano count1 to 4904May haveUnknown
South Carolinano count1 to 49045YesUnknown
Vermontno count1 to 4903May haveUnknown
Wyomingno count1 to 4900NoUnknown
All fifty states33,742 19,59512,883 3121

Counts as published or stated by each state health department, compiled September 11, 2026 from the linked sources. Forty-two states report a number and they total 33,742. New York and Florida are shown on their May 1 series; no count means the state has published no 2026 figure. CDC all cases is CDC’s range for confirmed U.S.-acquired cases by state of residence as of September 8 (the District of Columbia is 1 to 49); CDC publishes it only in ranges. CDC outbreak is its final September 11 count for the lettuce outbreak by state of exposure. Lettuce is whether FDA confirmed that recalled product reached the state. Every count is a floor.

What changed since my September 8 chart: a new column carries CDC’s national range for each state, the outbreak column is now CDC’s final per-state count rather than August 27 figures, and Virginia joined the outbreak with 12 cases. New York posted 1,042 cases through September 8, up from 939. Kansas is at 840. Colorado, Utah and New Mexico are updated from later reports to 178, 48 and 5; Utah says all but five of its 48 traveled. Michigan’s 14,718 stands until the state’s next update on October 1.

Ninety-six percent of the people on CDC’s chart were sick before the recall

CDC’s epidemic curve covers 10,949 people, 85 percent of the outbreak, whose onset dates are known. Illnesses came in two waves, a smaller one peaking June 24 and a far larger one on July 8, 9 and 10, when 1,047, 1,096 and 1,214 people got sick. Those three days account for 3,357 people, nearly a third of the chart. By the July 17 recall, 96 percent of the people on the chart had already fallen ill. In all of August, 27 did.

CDC’s outbreak epidemic curve, September 11. The recall came on July 17, after the tallest bars.

The outbreak was first identified on June 29, when the Monroe County Health Department in Michigan announced it was investigating a cluster. About 2,100 people on CDC’s chart were already sick. Symptoms usually begin about a week after exposure, so most people who fell ill July 8 to 10 probably ate contaminated lettuce in early July, after the cluster was public and two weeks or more before the recall. I cannot say how many faster tracing would have protected. That window is what the federal traceability rule was written for.

Testing finished lettuce would not have caught it. As of August 27, FDA reported no confirmed positive product samples, and Taylor Farms has disclosed that roughly 2,000 samples of its own, taken in central Mexico since May, came back negative. Prevention has to happen before the lettuce is cut.

FDA’s letter to the produce industry points to the right places

The letter is addressed to every link in the chain, at home and abroad. It reminds industry that it must apply science-based water management, worker hygiene and sanitation under the Produce Safety Rule, and that processors need strong supplier programs. It asks every organization to find where practices fall short and develop new science-based ones, and says FDA wants to work with an industry coalition on an ongoing basis.

The letter does not name Taylor Farms, iceberg lettuce, Mexico or the number of people who got sick, and it sets no deadline or new requirement. It is still right about where the answer is: water, workers and suppliers.

The call for new practices is also an honest one. FDA’s own Cyclospora Prevention, Response and Research Action Plan, released in 2021, says typical chemical treatments used on farms are not effective against the parasite and that farmers have limited options once it is in the environment. In August the agency’s fresh-cut guidance acknowledged the same thing about wash water in processing plants.

Four things that would prevent the next Cyclospora outbreak

Finish the investigation and publish it, water results included. The sample results from the growers and the plant, and a root cause analysis, belong on the new prevention page FDA says it will post. This is not the first Cyclospora outbreak traced to Taylor Farms de Mexico. In 2013 the company said it was testing the water at Doctor Mora, in Guanajuato, and FDA let the plant reopen. Thirteen years later, I have not found a single public result.

Test the water for the parasite, not just for bacteria. The Produce Safety Rule’s water standards are built around generic E. coli, a bacterial indicator, and the 2024 revision replaced numeric pre-harvest testing with annual written assessments. Neither was designed to find a chlorine-resistant parasite. FDA has had a validated method for detecting Cyclospora in agricultural water since 2020. Growers in regions with repeat outbreaks can run it through the season, and buyers and importers can require it in their supplier programs, starting next spring. Field toilets, handwashing and worker health rules are already required and should be verified in the field during harvest.

Make traceability enforceable now. The Food Traceability Rule requires companies handling leafy greens and other high-risk foods to keep lot-level records and hand them to FDA within 24 hours. Its January 20, 2026 compliance date was pushed to July 20, 2028, and in November 2025 Congress barred FDA from spending money to enforce it before then. That provision can be repealed in the next appropriations bill. The International Fresh Produce Association called in July for Congress and the administration to implement end-to-end traceability, and Western Growers told the Guardian it supports the rule. That is the beginning of the coalition FDA says it wants.

Fund the laboratories and the testing that find outbreaks. Whole genome sequencing is not available for Cyclospora the way it is for Salmonella, which is why genotyping by CDC and state laboratories matters. In August it gave this investigation its first laboratory evidence that the illnesses shared a common source. Testing sick people matters too. A nurse practitioner at a Lee County, Florida clinic serving mainly uninsured patients told Gulf Coast News Now the clinic was not testing anyone, because testing is expensive for the uninsured. An outbreak is found only as fast as sick people are counted.

I would like to go out of the lettuce business

I have been suing lettuce companies for nearly thirty years. I used to be in the hamburger business, too. From the Jack in the Box outbreak in 1993 through the ConAgra recall in 2002, E. coli in ground beef was a large share of my practice, and today it is close to zero. That happened because USDA declared E. coli O157:H7 an adulterant in ground beef in 1994, the industry learned to test for it, and the rules were enforced. It is the best thing to happen in food safety in my lifetime, and I was glad to lose that business.

FDA’s letter asks the produce industry to build that kind of change alongside the agency. I hope it works, and that the coalition includes the investigators who find these outbreaks and the families who live through them. The lettuce is off the shelves and the outbreak is over. The conditions that put a parasite from human waste onto lettuce bound for 21 states are still there, and the season starts again on May 1.

When FDA closed #1382, a fourteen-person E. coli O157:H7 outbreak, it named romaine lettuce as the likely source and said on its CORE investigations table that the product was beyond shelf life by the time investigators identified it. It named no grower and no processor. No product on the market is also why FDA never publicly named anyone in the 89-person romaine outbreak of 2024, #1280, which hospitalized 36 people and killed one.

FDA has not always treated a missing product as a reason to keep the source quiet. In at least eight outbreaks since 2006, FDA or CDC named the farm, processor or brand after the food was past its shelf life or out of commerce. Each example links to a source you can check.

2006: Dole spinach. A processor, four ranches, the grower and the harvesters, named in the final report

The outbreak was over, and the spinach had been recalled for six months, when FDA and California released their final report in March 2007. The outbreak sickened 205 people and killed three. The report, co-written by FDA’s San Francisco District, names Natural Selection Foods as the processor and the Paicines Ranch in San Benito County as the one where the outbreak strain was found, and names Mission Organics as the company that farmed the field. It also names the growers and harvesters of three other fields that did not match, and the maker of the fertilizer used at Paicines.

2013: Taylor Farms de Mexico. Named after Iowa and Nebraska said the salad was gone

In an August 2, 2013 statement, FDA named Taylor Farms de Mexico as the common supplier behind restaurant illness clusters in Iowa and Nebraska, after health officials there said the salad mix was likely out of the food supply. The last illnesses in those states were July 2, and salad mix lasts about two weeks. An FDA spokeswoman identified the restaurants to CNN as Red Lobster and Olive Garden. Bruce Taylor told NBC News the company’s tests had all been negative.

April 2018: Harrison Farms. Named by CORE’s own director after the season ended

The director of FDA’s Coordinated Outbreak Response and Evaluation Network, the office that closed #1382, named Harrison Farms of Yuma as the source of whole-head romaine that sickened eight people at an Alaska correctional facility. FDA said the farm’s romaine was harvested March 5 to 16 and was past its 21-day shelf life, and the farm was growing grass. The wider Yuma outbreak was still open, and FDA later said it could not be explained by a single grower.

July 2018: Fresh Express and Caito Foods. Named after the salad mix and wraps expired

FDA announced that it had confirmed Cyclospora in an unused package of salad mix processed by Fresh Express in Streamwood, Illinois, for McDonald’s. The package’s July 19 expiration date had passed, and Fresh Express said romaine from the same lot had also expired. USDA’s Food Safety and Inspection Service then named Caito Foods and retailers including Kroger, Trader Joe’s and Walgreens for salads and wraps made with that romaine, all dated July 18 to 23. FDA itself declined to name Fresh Express’s other customers, citing confidential business information.

December 2018: Adam Bros. Farming. A romaine farm named after its romaine was off the market

FDA Commissioner Scott Gottlieb and Deputy Commissioner Frank Yiannas announced that the outbreak strain had been found in sediment in an irrigation reservoir on a farm operated by Adam Bros. Farms in Santa Barbara County. They confirmed the farm had not shipped romaine since November 20. They reported that records from five restaurants in four states pointed to 11 distributors, nine growers and eight farms, with no single establishment common to every supply chain. CDC’s final notice says the farm’s romaine linked to the outbreak was no longer for sale.

2021 and 2022: Three brands named after their dates had passed

In November 2021, FDA identified Josie’s Organics Baby Spinach after Minnesota found the outbreak strain in a package from a sick person’s home. Its best-by date, October 23, had passed before CDC told people not to eat it. On December 30, 2021, CDC named Simple Truth Organic and Nature’s Basket Organic Power Greens, and Washington health officials told people to discard packages with best-by dates through December 20. FDA later reported that traceback reached farms in Yuma and Salinas without a single production code. In May 2022, FDA named FreshKampo and HEB fresh organic strawberries in a hepatitis A outbreak while saying the berries were past shelf life. The strawberry advice concerned frozen berries and vaccination after exposure.

USDA does this as a matter of routine

When meat or poultry is no longer for sale, USDA’s Food Safety and Inspection Service issues a public health alert instead of a recall, and it names the company. In April 2024, for example, it issued an alert namingGreater Omaha Packing for ground beef that may have carried E. coli O157:H7, stating that a recall was not requested because the product was no longer available. FSIS typically notes that product may still be in freezers.

What FDA disclosed when it did not name anyone

Frank Yiannas served as deputy commissioner from December 2018 to February 2023. On October 31, 2019, FDA announced a 23-person romaine outbreak that had already ended, with the romaine past its shelf life when it was identified, which is the #1382 situation. FDA still listed cases in each of twelve states, eleven hospitalizations and onset dates. It said investigators sampled central coast California farms identified in traceback, did not find the outbreak strain, and did not identify a common source. FDA said it was sharing the details to ensure “full awareness by the public.” The Washington Post reported that the agencies had settled on romaine on October 2. In the fall 2019 Salinas outbreaks, FDA said traceback found a common grower and at least ten fields and never named the grower. In both cases the public learned whether traceback converged. The #1382 closure does not say.

Not random. Ungoverned.

Only the 2006 report came after an outbreak had fully ended. In the other seven, part of the investigation was still open, and FDA could say the name served that investigation. Side by side, these cases can look random, but they are not quite that. A few things predict when FDA names a company: a positive lab sample, as with Adam Bros., Fresh Express, Josie’s and the 2006 spinach; a consumer brand rather than a grower, which is why Josie’s was named and its farms were not; and something the public can still do, such as check a freezer or get a vaccine.

None of those factors holds up. FDA named Harrison Farms on traceback while saying it had not determined how the lettuce was contaminated. In #1280, traceback led to one processor and one grower, and FDA named neither. In 2019, FDA disclosed a common grower in Salinas and kept the name. In 2006, it named companies whose fields came back clean.

I can find no published FDA standard for naming a company once product is off the market, and the reasons change with the case: in 2019 it was the absence of actionable information for consumers, in 2025 it was product people might have frozen, and in 2026 it was shelf life. A decision made without a rule can be neither predicted nor reviewed.

The fix is a written rule. When traceback converges on a single grower or processor, FDA should name it, whether or not product remains on the market. At every closure, FDA should publish the states with cases, the hospitalizations, and whether traceback converged at all.

What this means for #1382 and #1280

In #1280, FDA released a traceback summary with the processor and grower blacked out, then released it in stages without redactions. It shows a single processor and a single grower, Taylor Farms of California and Anthony Costa & Sons. Taylor Farms has denied that its product was the source. In #1382, FDA’s closed row shows traceback and no FDA inspection, sampling or recall, and FDA has not said whether traceback led to one grower or many. I am asking FDA and CDC for the #1382 records under the Freedom of Information Act, and I will report what comes back.

Why transparency and disclosure matter

I have made this argument since 2011. A name is not a punishment. It is the only thing that lets a consumer, a buyer, a regulator or a juror connect this outbreak to the last one. Withhold it, and every outbreak arrives looking like the first one anybody has ever had. The 2021 romaine E. coli O121 outbreak and #1280 both closed without a name, and both were later tied to Taylor Farms through records obtained afterward.

Silence also shifts the cost onto companies that did nothing wrong. During this summer’s Cyclospora outbreak, 6.5 million households stopped buying salad mixes and kits in a single month. When an agency says “romaine” and stops, every romaine grower shares one company’s outbreak, and no buyer can weigh a supplier’s history kept in a sealed file.

An outbreak with no name also teaches nothing. The 2018 Adam Bros. reservoir finding which FDA laid out in a report on the fall 2018 outbreak, and the 2006 Paicines Ranch report gave every grower something concrete to act on because investigators could say where. A closure that says only “romaine” gives them nothing.

The name is also the incentive. As I wrote in 2012, bad publicity is expensive, and poisoning your customers is more expensive. Silence whenever the lettuce is gone removes that incentive from produce outbreaks, which are often solved only after the lettuce is gone.

Federal officials are poised to declare the end of the largest known Cyclospora outbreak in the history of the United States. I did not learn that from CDC or FDA. As I write this, CDC’s own outbreak page, stamped September 3, still lists the investigation as open. I learned it the way the country has learned a good deal about this outbreak, from a newspaper. Two people familiar with the matter, speaking on condition of anonymity, told Rachel Roubein of the Washington Post this afternoon that the announcement could come as soon as today, though the timing is not guaranteed. The Department of Health and Human Services did not comment. 

It is not the first time the explanation went to a reporter before it went to the public. When people asked why FDA waited nearly a month after naming Taylor Farms to send investigators into the fields in central Mexico, the answer came from Donald Prater, FDA’s acting deputy commissioner for food, in an earlier interview with the Post. The agency, he said, first worked to reconstruct conditions during growing and harvest so it could put its resources where they would count. That is a reasonable answer. It belongs on the agency’s outbreak page, where anyone can read it.

The outbreak count stopped. The counting did not.

The outbreak FDA and CDC attribute to iceberg lettuce from Taylor Farms de Mexico stands at 11,458 illnesses in twenty states, at least 495 hospitalizations and two deaths in Michigan, with onsets from June 14 through August 15. Neither agency has changed that number since August 27, and on September 3 CDC said it would stop updating that page weekly.

The national count kept going. On September 8 CDC reported 19,595 laboratory-confirmed cases of cyclosporiasis acquired in the United States since May 1, with 1,043 hospitalizations, in forty-nine states and the District of Columbia, against 1,180 for the same stretch of 2025. One week earlier the figure was 18,445. CDC also lists 9,355 laboratory-confirmed cases still being sorted into domestic or travel-acquired, and at least 6,149 more that are not laboratory confirmed or are waiting on a patient interview. The agency’s own page says reports take about six weeks to arrive and that it will keep finding cases after the season’s August 31 close. Michigan alone reported 14,718 cases and 366 hospitalizations as of September 3.

Subtract the outbreak from the national count and 8,137 laboratory-confirmed illnesses sit outside the lettuce outbreak with no food named. The two figures carry different dates, so treat that as approximate, but it is not small. The Post said it plainly: nobody has identified the source of those other outbreaks. Declaring the lettuce outbreak over does nothing for those people.

Over is a statement about the calendar, not the cause.

When CDC calls an outbreak over, it is making an epidemiological statement: new illnesses tied to the source have stopped arriving. It is not a finding about how the parasite got onto the lettuce. FDA says that work is ongoing, and I take the agency at its word. But I have watched how these end. In September 2020 CDC declared the Fresh Express bagged salad Cyclospora outbreak over, and FDA’s page still says the cause or source was not determined. In 2013 FDA let Taylor Farms de Mexico reopen its plant on the company’s commitment to test its products and water supply for the parasite, and thirteen years later I cannot find one public result. Today FDA also closed a fourteen-person E. coli O157:H7 outbreak on its outbreak investigation table, naming romaine lettuce and nobody who grew or processed it. An outbreak can be over while the question stays open for good.

Congress asked. Nobody has answered.

Between July 14 and August 13, members of the House and Senate sent thirteen letters about this outbreak to HHS, FDA, CDC and twice to the chief executive of Taylor Farms. Eight set a deadline. All eight have passed, the last on August 27. As of this afternoon I cannot find a published answer to any of them, and I cannot find a hearing noticed in any committee. I laid out that record yesterday. Nothing in it has changed, except that HHS now has one more question it declined to answer, this time from a reporter.

What I have proposed, and who has answered.

I have not just complained. Since July I have put specific fixes on the record, and each of them can be done with authority and tools that already exist.

Test agricultural water for the parasite itself. The generic E. coli testing the industry relies on does not tell you whether Cyclospora is present. FDA has had a validated laboratory method for finding the parasite in agricultural water since 2020. Growers in regions with a Cyclospora history should be using it, and the results should be public.

Put the traceability rule back on a calendar. Congress used Section 780 of last November’s continuing resolution to bar FDA from spending money on enforcing the Food Traceability Rule, whose compliance date had already slid to July 2028. The Consumer Federation of America’s review of this traceback found that records the rule would have required within twenty-four hours took nearly two weeks to arrive. Eleven consumer, public health and labor groups have asked Congress to reverse it. Unwind Section 780.

Pay for the people who do the counting and make testing free for people who cannot pay. In Lee County, Florida, a clinic serving mainly uninsured patients told a reporter it had stopped testing for the parasite because its patients could not afford it. A count is only as good as the people who can pay to get into it.

Name the grower and the processor when traceback converges on them, and do it in the outbreak notice, not months later in a lawsuit. And answer the mail or hold the hearing. The Senate Permanent Subcommittee on Investigations held a Cyclospora hearing on imported raspberries in 1998, when the case count was in the hundreds.

None of this is exotic, and none of it needs a new agency. From the agencies that could act on it and the committees that could hold a hearing, I have heard nothing.

I know this kind of fix works because I watched one work. After Jack in the Box, USDA declared E. coliO157:H7 an adulterant in ground beef in 1994. The hamburger cases that filled my practice from 1993 to the 2002 ConAgra recall are now close to zero for my firm. It is the best thing that has happened in food safety in my lifetime, and it happened because somebody with authority decided to use it.

The file I am not closing.

The government may close the book on the lettuce today, or next week. The 8,137 people with no named source are not closed, and neither am I. Over the fall and winter, I will be working with epidemiologists on where those people got sick. When we find something, it will be here, with the documents, the day we have it. Nobody will need two anonymous sources.

On September 10, 2026, the U.S. Food and Drug Administration closed its investigation into a fourteen-person E. coli O157:H7 outbreak, reference #1382, and for the first time told the public what the food was: romaine lettuce. It named no grower, no processor, no brand and no state where anyone got sick. It said the lettuce was past its shelf life by the time investigators identified it, and the Centers for Disease Control and Prevention had declared the outbreak over on July 29. For ten weeks, the only public record of this outbreak was a single row on a federal table that read “Not Yet Identified.”

What FDA’s table said about #1382, week by week

FDA’s Investigations of Foodborne Illness Outbreaks table is the only place this outbreak ever appeared in public. Here is every version of the #1382 row I captured between July and September.

Table versionFood listedCasesOutbreakInvestigation
Week of July 8Not Yet Identified14OngoingActive
August 6Not Yet Identified14EndedActive
August 12Not Yet Identified14EndedActive
September 2Not Yet Identified14EndedActive
September 10Romaine Lettuce14EndedClosed

Source: FDA CORE investigations table, versions captured the week of July 8 through September 10, 2026. FDA posted #1382 to the table on July 1.

The case count sat at fourteen from the table’s second week to the day the file closed. I did not capture every weekly version, but in every one I have, the food column was blank until September 10. I could find no CDC outbreak notice for #1382 at any point, and no news report naming romaine before the closure.

What FDA said when it closed the file

FDA’s closing note says that people who got sick told CDC investigators they had eaten romaine, that epidemiologic and traceback data from CDC, FDA and state and local partners identified romaine as the likely source, and that by then the product “was beyond shelf life.” The closed row shows that FDA traceback was initiated. The inspection box is blank. The sampling box is blank. No recall was initiated. FDA’s own table definitions say the inspection column counts only FDA’s work and that state, and local partners may inspect on their own, so the fair reading is that FDA itself did not inspect or sample, not that no one did.

What the closure leaves out matters as much as what it says. It does not say how many states had cases, how many people were hospitalized, or whether anyone developed hemolytic uremic syndrome. It does not say when investigators settled on romaine. And it does not say whether traceback led to one grower and one processor or fanned out across many.

FDA has answered those questions before

This is not the first time FDA has closed a romaine outbreak after the lettuce was gone. In October 2019, it tied a twenty-three-person E. coli O157:H7 outbreak to romaine after the fact, with the product already past its shelf life. That time, FDA issued a standalone public notice listing cases in twelve states and eleven hospitalizations, with a statement from its deputy commissioner for food policy urging the leafy greens industry to improve traceability.

FDA has also said plainly when traceback did not point to a single source. In the spring 2018 Yuma outbreak, it said the illnesses could not be explained by a single grower, harvester, processor or distributor. In a fall 2020 E. coli O157:H7 outbreak, it said traceback identified no single farm as a common source. The #1382 closure says neither that traceback converged nor that it fanned out.

Will FDA name the grower or processor?

Not on its own, if past practice holds. FDA’s table definitions say that once it closes its response, it will embed an Executive Incident Summary Abstract in the reference number, so a #1382 abstract should appear. It will probably describe the traceback. It will almost certainly not name anyone. Food Safety News reported that the first abstracts named no restaurants, stores or growers.

The abstract for #1339, a 2025 Salmonella outbreak tied to spring mix, shows how it works. It says the traceback legs converged on a supplier and processor of packaged organic salads, and FDA blacks out the name. It blacks out even the number of traceback legs.

Why the 2024 romaine outbreak matters here

I have been writing about #1280 since the fall of 2024. It was an E. coli O157:H7 outbreak tied to romaine that sickened 89 people in 15 states, hospitalized 36, gave seven hemolytic uremic syndrome and killed one. FDA closed it with nothing but “Romaine Lettuce” on its table. During the investigation, FDA said the lettuce blend involved appeared to be past its shelf life.

When FDA first released its traceback summary, the processor, grower and ranch were all blacked out under the (b)(4) exemption. I stayed on the agency, and in stages it unredacted the file. The traceback led to a single processor, Taylor Farms of California in Salinas, and a single grower, Anthony Costa & Sons of Soledad. Taylor Farms has denied that its product was the source.

The shelf-life reason FDA gave in 2024 is the same one it gives now. It was not a good reason then. A best-by date protects no one by the time a file closes. A name lets other buyers question their suppliers, lets the people who got sick understand what happened to them, and gives the grower and processor a public reason to find and fix the problem.

What FDA should say about #1382 now

Four questions can be answered without harming anyone. 

  • Did traceback lead to one grower and one processor? 
  • How many states, hospitalizations and HUS cases were there? 
  • When did investigators identify romaine? 
  • Did any state inspect a farm or a plant? 

If the answer to the first question is yes, the names should be public, exactly as I have argued for #1280.

When the #1382 abstract posts, I will write about what it says and what it blacks out. The history is in my running list of E. coli outbreaks linked to romaine lettuce.

FDA’s internal records on two E. coli O157:H7 outbreaks linked to Raw Farm LLC of Fresno, California, show the agency suspected in February 2024 that Raw Farm was putting milk from cows that had tested preliminary positive for pathogens into its raw cheddar cheese. Two years later, after a second outbreak linked to the same cheese sickened nine people, most of them small children, FDA inspectors documented the practice.

The records, released with Freedom of Information Act redactions, cover CARA #1215, the 2023–2024 outbreak that sickened 11 people in five states, and CARA #1369, the 2025–2026 outbreak, including FDA’s incident logs, closing summaries, a sequencing report, and Health Hazard Evaluations signed in June 2024 and April 2026.

What did FDA know about Raw Farm in 2024?

CDC told FDA’s Coordinated Outbreak Response and Evaluation (CORE) Network about the first cluster on February 9, 2024. It grew to 11 cases in California, Colorado, New Jersey, Texas and Utah. Five people were hospitalized, and two developed hemolytic uremic syndrome (HUS). Seven of the 10 people interviewed reported eating Raw Farm raw cheddar in the week before they got sick, against 4.9 percent in CDC’s FoodNet Population Survey.

FDA’s February 15, 2024, incident briefing says the firm’s own account of its cheesemaking “appears to indicate that the firm uses potentially contaminated milk from cows that have tested preliminary positive for pathogens in their cheese production,” relying on the aging requirement for raw milk cheese. The traceback summary is blunter: “Milk from sick cows was diverted to make raw milk cheddar cheese for both the shredded and block cheeses.” The briefing adds that earlier FDA inspections had found inadequate preventive controls, and that about half of Raw Farm’s cheddar shipped out of state, beyond the reach of the 2010 federal injunction, which covered raw milk but not aged raw cheese.

FDA drafted an assignment to collect shipment and lot code records at Raw Farm itself. It was never issued. The Office of Chief Counsel advised against it “due to ongoing litigation activities and communication challenges with the firm.” The three traceback assignments FDA did issue, to retail and distribution points, were conducted remotely and closed with no Form 483.

Raw Farm recalled certain lots on February 16, 2024. Ten days later it issued a press release withdrawing and concluding that recall. FDA’s consumer advice did not change, and its June 10, 2024, Health Hazard Evaluation found that people who ate the cheese were at high risk of illness that could be fatal. The closing summary concludes, “Although we don’t know how the contamination occurred, Raw Farm-brand Raw Cheddar cheese was determined to be the source of the outbreak.”

How did FDA link the 2026 outbreak to Raw Farm?

CDC flagged the second cluster on March 10, 2026, and named Raw Farm raw cheddar the suspect on March 13. At closure there were nine cases: seven in California and one each in Florida and Texas. The median age was 2. Three people were hospitalized and one developed HUS. All eight people asked reported eating or being served raw milk or cheese, against 6.4 percent in FoodNet, and all seven who knew a brand-named Raw Farm.

The 2026 evaluation explains why cases came in two waves. Three people fell ill in September 2025 after drinking Raw Farm raw milk; the rest fell ill in January and February 2026 after eating Raw Farm cheddar. FDA wrote that milk from the same supply that sickened the first group was likely diverted into cheese without an intervening step, aged, and sold.

What did FDA inspectors find at Raw Farm in 2026?

FDA’s for-cause inspections ran from March 19 into the second week of April 2026, doubling as follow-up under the 2023 Consent Decree, and ended with Form 483 observations at three sites. At the Fowler creamery, FDA found the firm using raw milk that had tested positive for pathogens to make raw cheese and storing raw milk without temperature control. At the Hanford cheese plant, FDA found Raw Farm had never scientifically shown that its aging process controls pathogens, that employees cleaning the processing room spread potential contamination from the floor, and that the firm did not follow its own environmental testing procedures. At the Hanford dairy, FDA saw uncleaned milking equipment, poor hand and glove hygiene, and manure on the teat of a cow being milked.

The incident log adds more. Employees did not change gloves between washing down manure and handling the milking claw. Raw Farm’s pathogen testing protocol did not test its 8-ounce and 16-ounce finished packages, the ones people buy. On the first day of the inspection, Raw Farm reported that it had destroyed seven batches made with positive milk that had tested negative as finished product and had stopped using positive milk for cheese.

Does aging raw milk cheddar kill E. coli?

Not reliably. Federal rules allow cheddar to be made from unpasteurized milk if it is cured at no less than 35°F for at least 60 days. FDA redacted the length of Raw Farm’s aging process. At Hanford, Raw Farm’s own testing found pathogens in cheese that had finished aging, made from milk that first tested negative, which FDA wrote “shows the aging process does not control pathogens in the raw cheddar cheese products.”

The 2026 evaluation names the underlying policy, diverting pathogen-positive milk into cheese without an intervening step, as a contributor to Raw Farm’s outbreaks, because aging “does not guarantee pathogen elimination.” The question was not new; the 2024 briefing notes an earlier FDA outbreak investigation had already asked whether aging eliminates pathogenic E. coli.

Did FDA find E. coli in Raw Farm cheese?

Not the outbreak strain, in either outbreak. In 2026, however, a block of raw cheddar FDA collected at the Hanford plant on March 31 tested positive for a different strain of E. coli O157:H7. Raw Farm said the batch was never distributed. FDA’s April 15 sequencing report matched it to 19 clinical isolates from 2025, three of them within 1 to 8 SNPs, or single-letter genetic differences. Many were tied to a fall 2025 cluster CDC closed without identifying a food. FDA did not count those illnesses in this outbreak because there were no epidemiologic links, and nothing in the released records shows whether those patients were later asked about Raw Farm.

Why did the 2026 Raw Farm recall take three weeks?

The 2026 evaluation lays out the calendar. On March 13, FDA and CDC told Raw Farm its products were linked to the outbreak and asked for a recall decision within 24 hours. On March 14, the firm declined. On March 16, a business whose name FDA redacted issued a recall notice for all Raw Farm raw cheese sold in stores. On March 27, FDA asked again, recommending a recall of all cheese sold or distributed after December 15, 2025. On March 28, Raw Farm asked for more information. It told FDA on April 1 that it would recall, announced the recall April 2, and issued an updated release April 7 covering cheese with expiration dates from May 6 through September 24, 2026.

I wrote in Food Safety News on April 1, while the company was still refusing, that Raw Farm has a long history of outbreaks linked to its products. FDA’s files now tell it in the agency’s own words.

What is Raw Farm’s outbreak history?

My April 1 column traces outbreaks and recalls back to 2006 under Raw Farm and its predecessor, Organic Pastures, including E. coli O157:H7 outbreaks linked to its raw milk in 2006, 2011 and 2016 and to its raw cheddar in 2023–2024 and 2025–2026, and a 2023–2024 raw milk Salmonella Typhimurium outbreak California counted at 171 illnesses. FDA’s 2026 evaluation says the string of recent outbreaks demonstrates “the firm’s systematic potential to produce unsafe fluid raw milk and raw milk cheddar cheese.” Organic Pastures pleaded guilty in 2008 to two misdemeanor counts of introducing misbranded food into interstate commerce, a permanent injunction followed in 2010, and a 2023 Consent Decree gave FDA the right to inspect without notice.

What would have prevented this?

Two rules would have mattered. Milk that tests positive for a pathogen should never become raw milk cheese; Raw Farm told FDA it would stop only during the March 2026 inspection, two years after FDA first wrote down its suspicion. Finished retail packages of raw milk cheese should be tested before they ship; Raw Farm’s protocol did not test them. FDA should write both into its standards for raw milk cheese rather than wait for a third outbreak.

Was Raw Farm raw cheddar cheese recalled?

Yes, twice. Raw Farm recalled certain lots on February 16, 2024, and withdrew that recall ten days later. It recalled its raw cheddar again on April 2, 2026, and expanded the recall on April 7 to cheese with expiration dates from May 6 through September 24, 2026.

FDA Documents

https://www.marlerblog.com/files/2026/09/1369-Records-FInal_Redacted.pdf

https://www.marlerblog.com/files/2026/09/CARA-1215-Records-Final_Redacted.pdf

The seed supplier FDA has declined to name in the alfalfa sprout outbreak that has sickened 55 people in 15 states is International Sprout Holdings, Inc., which does business as International Specialty Supply in Cookeville, Tennessee. My friend Phyllis Entis, the FoodBugLady, found it today in FDA’s weekly Enforcement Report and published it on eFoodAlert: a recall of 43,799 pounds of alfalfa seed from a single lot, ISS Lot # SAL2-24JB, sold in 50-pound bags, which the company began on August 23 by emailing its customers.

That is roughly 876 bags of seed, shipped to wholesale customers in California, Florida, Hawaii, Illinois, Massachusetts, Minnesota, Missouri, Montana, New York, Ohio, Oregon, Pennsylvania, South Carolina, Tennessee, Texas and Utah, plus Puerto Rico, Canada, Mexico, Tahiti and Venezuela. None of those customers is named.

Credit where it is due.

Enforcement Reports are where recalls go when nobody sends out a press release, and it takes someone who actually reads them to find one. Phyllis does. She is a retired food safety microbiologist with degrees from McGill and the University of Toronto, the author of TAINTED: From Farm Gate to Dinner Plate, Fifty Years of Food Safety Failures, and she was writing eFoodAlert before Food Safety News existed. As of this afternoon I could not find the supplier’s name anywhere else. FDA’s outbreak advisory, last updated August 31, still calls it “a common seed supplier,” and CDC’s investigation page has not posted an update since August 24.

The name matters because the seed is the story. I wrote on August 20 that four organisms in one product is a seed signal, not a kitchen signal. FDA’s August 31 update moved the investigation from one sprouter to one seed lot. Today we know whose lot.

What two federal records say, eight days apart.

The Enforcement Report puts the start of the seed recall at August 23, one day after Everything Sprouts recalled its Calco and Everything Sprouts alfalfa. FDA’s August 31 advisory says the supplier told its customers not to use, grow, sell, transfer or redistribute the lot, and to return or dispose of any remaining seed. The same update says the supplier had not responded to FDA’s recall recommendation, had not sent a recall notice to downstream customers, and had not told the customers who received the lot to recall anything they grew from it.

Both can be true. Pulling seed still sitting in a warehouse is one thing. Recalling sprouts already grown from that seed and already sold is another, and that second step is what FDA asked for. On August 31 I wrote that “has not responded” is not the same as “refused,” and the Enforcement Report bears that out: the company acted on the seed itself within a day of the Everything Sprouts recall. What the public record still does not show is a recall of sprouts grown from lot SAL2-24JB by anyone other than Everything Sprouts. FDA says at least one other grower sprouted it. That grower has not been named, and no second sprout recall has been announced.

Where the seed went, and where people got sick.

Setting the seed list next to CDC’s illness map is worth doing, with care. Five states appear on both: Florida, Minnesota, New York, Pennsylvania and South Carolina. Minnesota is Everything Sprouts. Florida and New York each have two reported illnesses, and Pennsylvania and South Carolina one each. Whether those six people ate sprouts grown near home from this lot, or ate Everything Sprouts product while in the upper Midwest, is something FDA’s traceback can answer and the public record cannot.

Eleven states received the seed and have reported no illnesses: California, Hawaii, Illinois, Massachusetts, Missouri, Montana, Ohio, Oregon, Tennessee, Texas and Utah. Wisconsin, with 17 cases, is not on the seed list at all, which fits a Minneapolis grower shipping sprouts across the state line. Two caveats travel with that comparison. The seed went to wholesale consignees, who may have resold it elsewhere, and CDC’s states are where sick people live, not where they ate. CDC also says the true number of sick people is likely much higher and may not be limited to the states with known illnesses.

The Produce Safety Rule covers the sprouter, not the seed.

When FDA finalized its guidance on seed for sprouting in 2022, it counted 52 sprout outbreaks and more than 2,700 illnesses between 1996 and 2020, and said seed has historically been the likely source in many of them. In the same notice FDA said seed for sprouting is food but is not covered produce under the Produce Safety Rule, so growing, conditioning and distributing it are not subject to that rule’s requirements. The guidance is a recommendation. The sprout-specific requirements apply to the grower, and FDA sent Everything Sprouts a warning letter under that rule in March 2025. What FDA has written specifically for the seed supplier, the company that sells to sprouters in 16 states and four countries, is guidance.

Three questions for International Sprout Holdings and FDA.

Who is the second grower, where did it sell sprouts grown from lot SAL2-24JB, and has it recalled them?

The company says on its own website that it grows and tests all of its seed in-house. What did the testing of lot SAL2-24JB show before it shipped?

local business listing says the company also sells fresh sprouts to distributors, grocery stores and restaurants. Were any of them grown from this lot?

What to do.

The recalled Everything Sprouts products, Calco and Everything Sprouts alfalfa plus the Crunchy Protein, Zesty Garlic and Robust Radish mixes, are listed with lot numbers on FDA’s advisory. Sprouts grown from this seed lot by anyone else carry no recall notice, so there is nothing on the package to check. If you ate sprouts this summer and got sick with diarrhea, especially bloody diarrhea, see a doctor and ask for a stool test. Keep any packaging or receipt, and ask the lab or health department to preserve your isolate, because genetic sequencing is what ties one person’s illness to an outbreak.

Phyllis closed her post with the FoodBugLady’s standing advice: “DO NOT EAT RAW SPROUTS!” I have been saying the same thing for years. Thank you, Phyllis.