CDC named the source of the current Salmonella outbreak today — jalapeños from a grower in Sinaloa, Mexico, moved into the United States by Coast Citrus Distributors, 345 people sick (most in Minnesota and Colorado) in 27 states with 36 hospitalized. Chipotle and QDOBA pulled product.

It is not surprising. Fresh hot peppers and Salmonella have a documented relationship going back nearly twenty years, and every box of them runs through Mexico. Here is the record.

Start with the one everybody half-remembers. In the spring and summer of 2008, Salmonella Saintpaul sickened 1,442 people across 43 states, the District of Columbia and Canada, hospitalized at least 286, and may have contributed to two deaths. It was, at the time, the largest foodborne outbreak in the United States in more than a decade. Investigators spent months on raw tomatoes and destroyed the domestic tomato market doing it — growers put losses in the hundreds of millions. The New England Journal of Medicine account is the one to read: eating at a Mexican-style restaurant, eating pico de gallo, and having a raw jalapeño in the house all tracked with illness; jalapeños were implicated in every restaurant cluster with an identified ingredient; and the outbreak strain was recovered from a jalapeño at a produce importer in McAllen, Texas, from a jalapeño in a patient’s home in Montezuma County, Colorado, and from irrigation water and a serrano pepper on a farm in Mexico. Tomato traceback never converged on anything.

By July of that year FDA was advising consumers outright not to eat fresh jalapeños and serranos grown in Mexico, and Agricola Zaragoza of McAllen had recalled its jalapeños after one tested positive for the outbreak strain. Eighteen years later the shape of the thing is identical: a Mexican grower, a Texas or California importer, and a warning that arrives after the crop has been eaten.

The part of 2008 that deserves more attention than it gets came afterward, and it came from the Associated Press rather than from any agency. FDA’s food safety chief, Dr. David Acheson, told reporters that summer that the agency had not typically seen problems with peppers. The AP then went into FDA’s own border records and found that peppers and chilies had been the most frequently rejected Mexican crop for the preceding year — 158 intercepted shipments of fresh and dried chilies, eight percent of them carrying Salmonella, and in the first seven months of 2008 alone, 88 shipments turned away with ten percent contaminated. Fresh peppers specifically were being stopped as the outbreak ran: six separate shipments of fresh jalapeños and serranos were held in July after inspectors found Salmonella, and that August the agency added a dozen Mexican growers or distributors to its import alert list. The information was inside the building the entire time. Nobody had connected the rejection data to the illness data.

Eight years later it happened again on a smaller scale, and this time the sequence is almost unbelievable. In May through July 2016, 32 people in nine states were infected with a rare strain of Salmonella Anatum linked to imported hot peppers. In April 2016 — before a single case had been identified — FDA had already isolated that strain from an Anaheim pepper during routine produce sampling. The sample came from a consolidator and grower that supplied two of the restaurants outbreak patients later reported visiting. Whole genome sequencing showed the pepper isolate and 19 clinical isolates differed by zero to three SNPs. The agency had the organism in hand before the outbreak was recognized, and the match was only made in hindsight.

That 2016 investigation also documented the problem that is on display again right now. Investigators had to work from restaurant recipes because pepper varieties are nearly impossible for a sick person to identify once the pepper has been diced into salsa. Anaheim, jalapeño, poblano, serrano — a customer eating a burrito cannot tell you which one they ate, or whether they ate one at all. Add the fact that Mexican-style meals share a dozen common raw ingredients, and you get exactly what CDC published this week: a cluster analysis listing jalapeño peppers alongside red onion, cilantro and avocado.

Then there is FDA’s own prevalence data, which the agency generated and published, and which reads today like a warning nobody acted on. Under the FY2016–2017 hot pepper sampling assignment, FDA found Salmonella in 2.61 percent of hot peppers grown in Mexico — 29 positives out of 1,112 samples. Hot peppers from the Dominican Republic came back at 8.33 percent, seven positives out of 84. The Dominican result was strong enough that FDA ran intensified screening, got the same answer, and put two Dominican firms on Import Alert 99-23 for detention without physical examination. 

In the same date, one in every thirty-eight hot peppers FDA pulled from Mexican shipments carried Salmonella. That is not an anomaly, an outlier lot, or a bad season. That is the baseline condition of a commodity Americans eat raw.

Three. That is how many recognized multistate Salmonella outbreaks have been attributed to fresh hot peppers in the United States in twenty years: 2008, 2016, and this one. Three outbreaks, against a commodity that FDA’s own sampling says carries Salmonella at 2.61 percent, imported by the hundreds of millions of pounds a year, and eaten raw.

Those two facts cannot both be describing reality. Either peppers are contaminated at one in thirty-eight and almost never make anyone sick — which is not how Salmonella works — or we are catching a small fraction of the illnesses they cause. The 2016 investigation tells you which. That outbreak was solved because a laboratory happened to have sequenced a pepper two months earlier; without that isolate sitting in PulseNet, thirty-two people in nine states would have been an unsolved cluster and the peppers would have finished the season. The 2008 outbreak was solved after investigators spent a summer on the wrong commodity. The number of pepper outbreaks in the record is not a measure of how often peppers make people sick. It is a measure of how often we manage to prove it.

The reasons this commodity behaves the way it does are not mysterious. Fresh chilies are grown outdoors in warm climates, irrigated with surface water, harvested by hand, and eaten raw. There is no cooking step, no pasteurization, and no wash that reliably removes Salmonella from the crevice where the stem meets the fruit. Mexico supplies the overwhelming majority of the fresh jalapeños and serranos consumed in this country. The 2008 investigation found the outbreak strain in irrigation water on a Mexican farm. Sinaloa in 2026 is the same story with a different state and a different serotype.

The distribution layer makes it worse. Peppers move through consolidators — the 2016 investigation used exactly that word — who aggregate fruit from many small farms into a single lot. One contaminated field can seed a lot that reaches hundreds of restaurants in a dozen states, and traceback from the plate back through the consolidator to the field is slow enough that the crop is eaten before anyone finishes. Coast Citrus is playing that role in 2026. Agricola Zaragoza played it in 2008.

And the epidemiology is genuinely hard, which is worth saying honestly. Peppers hide in salsa. People do not remember eating them. Mexican-style restaurant meals bundle five or six raw produce items together, so the questionnaire cannot separate them. Investigators in 2008 chased tomatoes for months for reasons that made sense at the time and were wrong. Anyone tempted to be glib about this week’s pace should read the 2016 MMWR, which says out loud that the pepper hypothesis only came together because a laboratory match arrived to break the epidemiologic tie.

In today’s outbreak there is a recall of sorts, and it is worth being precise about what kind. FDA recommended that Coast Citrus Distributors pull the product; the company agreed to recall the remaining implicated product and is contacting affected customers. That is a recall of inventory, not of exposure — the peppers that sickened 345 people were eaten in June and early July and are long gone. It is also a recall conducted by private customer notification. There is no posted company announcement, no lot codes, no ship dates, and no consignee list. A restaurant that bought these peppers from a secondary distributor rather than from Coast Citrus directly has no way to find that out on its own. Here the advice to consumers is to ask the store where the peppers came from — which is to say, run the traceback yourself.

None of the difficulty above is new information, and that is the point. FDA has its own sampling data showing 2.61 percent Salmonella prevalence in Mexican hot peppers and 8.33 percent in Dominican ones. It has the 2008 outbreak, the largest of its era, with the strain pulled from irrigation water on the farm. It has the 2016 outbreak in which its own laboratory held the outbreak strain before the outbreak existed. It has border rejection records that the Associated Press could analyze, and the agency apparently could not.

In 2026 a grower in Sinaloa shipped jalapeños that put thirty-six people in the hospital across twenty-seven states, and the response was assembled in public, in pieces, over roughly seven weeks, with a distributor named on August 5 and the grower still unnamed tonight.

CDC posted an outbreak investigation page this evening. The numbers are 345 people sick in 27 states, 36 hospitalized — twelve percent of the 291 for whom that information exists — and no deaths. Illnesses began between June 19 and July 20. Of 191 people interviewed, 177 reported eating at a Mexican-style restaurant, Chipotle and QDOBA among them, with meal dates from June 14 to July 14. Investigators identified twenty-seven separate illness clusters at Chipotle and QDOBA locations across seven states.

And then the sentence everyone has been waiting three weeks for. Epidemiologic and traceback data show that jalapeño peppers from Sinaloa, Mexico, distributed by Coast Citrus Distributors, may be contaminated with Salmonella Javiana and are making people sick.

Now hold that up against what the FDA outbreak table says as I write this. Reference #1395, Salmonella Javiana, product linked to illnesses: Not Yet Identified. Total case count: 212. The recall column is empty. The on-site inspection column is empty. The page was last modified Tuesday morning at 9:30. CDC named a distributor and a growing region a day and a half later, and the federal table that most of the food industry actually watches has not moved a pixel.

That is a 133-case gap and a 25-state gap between two agencies working the same outbreak.

CDC published the state-by-state breakdown along with it.

Two numbers jump off that table, and they are the same number. Minnesota 110. Colorado 110. Those two states hold 220 of the 345 cases — sixty-four percent of a twenty-seven-state outbreak. Illinois is third with 30. Everything else is in single or low double digits, and eight states report exactly one case.

Now look at which states are high and which are low. California, with thirty-nine million people and Chipotle and Qdoba locations in nearly every city of size, reports one case. Texas reports three. Ohio reports two. Wyoming, with fewer than six hundred thousand residents, reports six. Montana reports five. Kansas reports thirteen — more than California, Texas, Ohio, Virginia and Washington combined. New York, Florida, Pennsylvania, New Jersey, Massachusetts and Arizona do not appear at all.

Nobody should read that as a map of where the peppers went, because it is not one. It is a map of which state public health laboratories sequence aggressively, interview quickly, and report what they find. Minnesota and Colorado sit at the top of this list for the same reason they were the first two states to say anything in public: they look. Somebody who ate the same pepper in a state that does not look is not in this table, and not being counted is not the same as not being sick.

Now the part that should bother you more than the arithmetic. CDC’s advice to businesses is to check their inventory for the recalled jalapeño peppers and not sell or serve them. I have looked for that recall. It is not in FDA’s recall column for this investigation. I cannot find a recall notice for Coast Citrus Distributors or for anybody else in this outbreak. Businesses are being told to pull a recalled product for which there is no published notice, no lot codes, no shipping dates, no brand names, and no distribution list. A restaurant manager who reads the CDC page tonight and goes to the walk-in has nothing to compare a case against.

And the grower still has no name. Read CDC’s own sentence carefully: FDA conducted a traceback and a common grower of jalapeños in Sinaloa that supplies Coast Citrus Distributors was identified as the likely source. Identified. Not named. Somebody has that name in a file right now. It has been in that file long enough for two national restaurant chains to have already pulled product on the strength of it.

I have written three posts in three days about this outbreak, and the through-line has never changed.

On August 3 the public count was 212 with no product named, and I laid out twenty-five years of Javiana history pointing straight at produce. On August 4 Chipotle pulled jalapeños after 110 fell ill in Minnesota and both federal agencies said nothing. That evening the scoreboard read Minnesota 110, Colorado 110, FDA 212, two states adding up to more than the national count. This afternoon Bloomberg reported that Qdoba had pulled jalapeños from more than eight hundred restaurants.

In seventy-two hours the public number went from 212 to 345 and the public state count went from two to twenty-seven. Almost none of that is new illness. The last onset date in CDC’s own table is July 20 — sixteen days ago. These people were already sick. What changed was disclosure, and it changed only after two restaurant companies and two Bloomberg reporters forced the issue.

A few things in the CDC data deserve more attention than they will get.

The commonly reported ingredients in those twenty-seven clusters were jalapeño peppers, red onion, cilantro, and avocado. Jalapeños are the lead, and the traceback supports it. But three other raw items are still sitting in that sentence, and anyone who lived through 2008 knows what it costs to lock onto one commodity too early — or, for that matter, onto the wrong one. Investigators chased tomatoes for months that summer while 1,442 people got sick and the domestic tomato market was destroyed, and the New England Journal of Medicine account later established that jalapeños were implicated in every restaurant cluster with an identified ingredient, with the outbreak strain recovered from a jalapeño in Texas and from irrigation water and a serrano pepper on a Mexican farm.

Two isolates carry resistance. One is predicted resistant to ampicillin, ceftiofur, ceftriaxone, streptomycin, sulfisoxazole and trimethoprim-sulfamethoxazole, and nonsusceptible to ciprofloxacin. Another is predicted resistant to azithromycin. Most people with Salmonella recover without antibiotics, but the ones who need them are the ones already in trouble, and in this outbreak thirty-six people were sick enough to be admitted. That detail belongs in front of treating physicians, not buried in a laboratory section.

The count is going up. CDC says so itself: it takes three to four weeks to determine whether a sick person belongs to an outbreak, and many people never get tested at all. The 345 is a floor.

Here is what should happen tomorrow morning.

Name the grower. FDA has the name. The agency’s own standard is that it will not name a specific product until there is sufficient evidence to implicate it — and CDC just published the implication. Whatever threshold FDA set for itself has been met by its sister agency in public.

Publish the recall. If jalapeños have been recalled, there must be a notice with firm names, lot codes, ship dates and consignees. If they have not been recalled, then CDC should not be telling businesses to check for recalled product, and FDA should explain why a product identified as the likely source of 345 illnesses is still legally in commerce.

Publish the distribution list. Chipotle and QDOBA are two customers of one distributor. Coast Citrus serves a great many more. Every one of them is entitled to know today, and so is every person who ate at one of them in June.

Update the table. Ref #1395 saying “Not Yet Identified” tonight is not a technicality. That table is what buyers, brokers, retailers and state agencies check. Leaving it stale while CDC names a distributor is how product keeps moving.

One last thing, because it is the only genuinely good news here. This outbreak’s first illness began June 19. A distributor and a growing region were named on August 5 — about seven weeks. In 2008 the same commodity, the same country, and a nearly identical epidemiologic picture took the better part of a summer and cost the tomato industry hundreds of millions of dollars for nothing. Faster is real progress and the people who did that work deserve to hear it said.

It is still not fast enough, and it is still not finished, because a grower in Sinaloa whose peppers put thirty-six people in the hospital has a name, and tonight the only people who know it are the ones who do not have to say it.

Qdoba Restaurant Corp. has pulled jalapeños from more than 800 locations and is cooperating with federal authorities investigating a Salmonella outbreak that has sickened hundreds of people across the country. The company has not said when the peppers come back or who provided them.

That is Bloomberg, this afternoon, by Daniela Sirtori and Jessica Nix. A tip of the pen to both of them, because they are the reason anyone outside the investigation knows there is a second chain.

Here is what the public record said before they filed. On Tuesday the Minnesota Department of Health named jalapeños as the suspected vehicle in a Salmonella Javiana outbreak and put its own count at 110. Carlota Medus, the senior epidemiologist supervisor in the state’s foodborne diseases unit (a.k.a “Team D”), said the food that made people sick was served at other restaurants as well. Laurie Schalow, Chipotle’s chief corporate affairs and food safety officer, said the peppers went to several food service retailers across multiple states. Colorado said it had 110 cases associated with the same outbreak and declined to say what they ate or where. FDA said it opened a traceback of multiple ingredients on July 22, carried the national count at 212, listed the source as not yet identified, and said it would say more if and when there was an actionable public health update.

Every one of those statements is true. Not one of them names anybody. “Other restaurants.” “Several food service retailers.” “Multiple states.” A person who ate a burrito in late June and then spent three days on a bathroom floor cannot do a single thing with that vocabulary. She cannot check whether she ate at one of the restaurants. She cannot tell her doctor what to test for. She cannot warn her sister.

Two reporters put one name on it, and the shape of the outbreak changed.

Consider the arithmetic. Chipotle pulled from the locations that received a common lot. Qdoba pulled from more than eight hundred. That is not solely a Minnesota problem, and it is not solely a Chipotle problem. It is a load of peppers that went into a national distribution system and came out the other side in thousands of kitchens, and the only reason we can see two of them is that a company confirmed it to a reporter who asked.

The question I want answered next is how Qdoba found out. If a distributor called Qdoba in July when the trace began, then the supply chain worked and the only failure is that the public was kept outside it. If Qdoba found out the way I did — by reading about Chipotle on Tuesday and going to look in its own coolers on Wednesday — then the notification system did not work at all, and every other buyer of that lot is currently in the same position Qdoba was in on Monday: serving the product and not knowing. Those are very different stories with very different consequences, and the answer exists today in somebody’s email.

We have run this exact play before. In 2008, Salmonella Saintpaul sickened 1,442 people in 43 states, the District of Columbia and Canada. Investigators chased raw tomatoes for months, wrecked the domestic tomato market, and only later established through the New England Journal of Medicine account that jalapeños were implicated in every restaurant cluster with an identified ingredient, with the outbreak strain recovered from a jalapeño in Texas and from irrigation water and a serrano pepper on a Mexican farm. The lesson everyone claimed to take from 2008 was that traceback has to move faster than the produce does. Eighteen years later, the federal traceback opened July 22 and the public got a name on August 5 from Bloomberg.

The recordkeeping rule that was supposed to fix precisely this — FSMA Section 204, the Food Traceability Rule, which would require lot-level records for leafy greens and fresh peppers among other high-risk foods — has been pushed to 2028. The industry asked for the delay. It got it. This is what the delay buys: a grower nobody can name, a distributor nobody can name, a retail list nobody will publish, and two chains that had to find the lot in their own coolers one at a time.

Somebody knows the grower’s name. Chipotle knew it well enough on Tuesday to stop buying. Qdoba knew it well enough by Wednesday to pull eight hundred restaurants. FDA has known it since the traceback opened two weeks ago. The only party still in the dark is the one that got sick.

FDA should publish the grower, the distributor, and the list of retailers that received the lot, today. Not because it makes an actionable consumer recommendation in the agency’s preferred sense of that phrase, but because eight hundred restaurants is an actionable consumer recommendation, and it took two reporters to produce it.

Daniela Sirtori and Jessica Nix did this week what the federal food safety apparatus is funded to do. They should not have had to.

Ninety-eight people in seventeen states, twenty-six of them hospitalized, illness onsets running from November 21, 2025 to June 30, 2026 — that is the Midwest Poultry Services outbreak as CDC has it today, and FDA says the recalled eggs do not account for all of the illnesses. I wrote about it last week and made the point that the interval between a swab and a carton is where these outbreaks live. Then someone asked me how far back that goes. I went and looked. It goes back further than the rule does.

Start in February 2001, in four prisons run by the South Carolina Department of Corrections. Of 2,317 inmates, 688 reported to prison infirmaries with cramps, diarrhea and nausea. Stool specimens yielded SalmonellaEnteritidis phage types 2, 13a and 23. Two case-control studies pointed at a tuna salad served for lunch on March 2, made with eggs the inmate kitchen staff had hard-boiled — and boiling, as CDC noted in the same report, does not finish the job unless the yolk goes completely solid.

All four facilities bought eggs from one vendor. The eggs traced back to that vendor’s farm. And in February 2001 — the month before the March outbreaks — eggs submitted from that farm to the South Carolina Egg Quality Assurance Program had tested positive for Salmonella Enteritidis phage types 2, 13a, 22, 23 and 28. Phage type 2 was the strain that predominated in the sick inmates. The farm was a participant in the state’s own voluntary control program, the program found the organism, and the eggs went to the prisons anyway. In April the farm withdrew from the program. In April the prisons switched to pasteurized egg product. Six hundred eighty-eight people are what happened between February and April.

It did not stop at the fence line. That June, CDC’s outbreak detection algorithm flagged a rise in North Carolina, where the state lab counted 51 Salmonella Enteritidis cases in July and 31 in August against eleven in each of those months the year before. A case-control study tied the illness to eggs, and twenty-one of fifty-three patients carried the same PFGE pattern — the same pattern, and the same phage type 13a, found in the South Carolina prisoners. Two states, one probable farm. The traceback from retail was inconclusive. Nobody was ever named.

Understand what that decade looked like underneath the outbreaks. From 1990 through 2001, state and territorial health departments reported 677 Salmonella Enteritidis outbreaks: 23,366 illnesses, 1,988 hospitalizations, thirty-three deaths. Of the 309 outbreaks with a confirmed vehicle, 241 of them — seventy-eight percent — were shell eggs, accounting for 14,319 illnesses. Twenty-two of the thirty-three deaths happened in institutions, in nursing homes and prisons and assisted living, to people who do not get to choose what is on the tray. And those are only the counted ones. USDA and CDC modelers put shell-egg SalmonellaEnteritidis illness in the single year 2000 at 182,060, with an uncertainty range topping out near 276,500.

FDA’s Egg Safety Rule arrived in 2009. Here is the whole record since, every multistate Salmonella outbreak traced to American shell eggs, and I would ask you to read it for the dates as much as the numbers:

2010 — Wright County Egg and Hillandale Farms, Iowa. S. Enteritidis. CDC counted 3,578 illnesses between May 1 and November 30 against a baseline near 1,639, leaving roughly 1,939 attributable. Half a billion eggs recalled, still the largest shell egg recall in American history. Congressional investigators later put in the record that environmental sampling in and around the cages between 2008 and 2010 had produced 426 positive Salmonella results at Wright County, seventy-three of them potentially Enteritidis. All of it before anyone got sick.

2015 and 2016 — Good Earth Egg Company, Bonne Terre, Missouri. S. Oranienburg, the same strain both times. Fifty-two sick in six states, a cease-operations order, negative resamples, a reopening — and then eight more sick in three states with two hospitalized, the outbreak strain recovered from eggs at a Missouri restaurant and from the processing facility itself, after which Missouri closed the operation for good.

2018 — Rose Acre Farms, Hyde County, North Carolina. S. Braenderup. Forty-five sick in ten states, eleven hospitalized, 206,749,248 eggs recalled. FDA’s warning letter found the outbreak strain in the processing plant and in manure from laying house No. 9, and rodents throughout.

2018 — Gravel Ridge Farms, Cullman, Alabama. S. Enteritidis. Forty-four sick in eleven states, twelve hospitalized — a thirty-two percent hospitalization rate against a twenty percent norm.

2024 — Milo’s Poultry Farms, Bonduel, Wisconsin. S. Enteritidis. Ninety-three sick in twelve states, thirty-four hospitalized, onsets May 23 to September 13.

2025 — August Egg Company, Hilmar, California. S. Enteritidis. One hundred thirty-four sick in ten states, thirty-eight hospitalized, one death. Onsets February 24 to June 6. 1.7 million dozen recalled. When CDC put out its first alert the day after the recall, the count stood at seventy-nine in seven states. It nearly doubled after the eggs came off the shelf.

2025 — Country Eggs, LLC, Lucerne Valley, California. S. Enteritidis, nalidixic-acid resistant. One hundred five sick in fourteen states, nineteen hospitalized, onsets January 7 to August 14. Four restaurant sub-clusters. FDA inspected and three environmental samples came back positive.

2026 — Midwest Poultry Services. S. Enteritidis. Ninety-eight sick in seventeen states, twenty-six hospitalized, 1,589,577 dozen recalled on July 22 — nineteen million eggs — and the investigation still open.

Now notice the hole in the middle. Between Gravel Ridge in September 2018 and Milo’s in September 2024 there is not one CDC-posted multistate egg outbreak. Six years. I do not believe for a minute that American laying hens took six years off. Four of these landed in the last three years, and the last three each ran seven or eight months of onsets before a carton moved.

The named multistate outbreaks since the rule add up to something under 2,500 counted illnesses. The 1990s counted 14,319 from shell eggs alone, and the modelers said 182,060 in a single year. The disease did not shrink by that ratio. What shrank is how often we go looking, and how fast we act on what we find.

Because the finding has never been the problem. South Carolina’s farm was in the quality assurance program. Wright County had 426 positives in its own files. Rose Acre had the strain in laying house No. 9. Country Eggs had it in three environmental samples. Midwest Poultry says its own monitoring is what caught this one. In every case somebody had the answer written down. The farm knew in February. The prisons ate in March. Twenty-five years of this, and it is still that same interval, dressed up as bad luck.