When FDA closed #1382, a fourteen-person E. coli O157:H7 outbreak, it named romaine lettuce as the likely source and said on its CORE investigations table that the product was beyond shelf life by the time investigators identified it. It named no grower and no processor. No product on the market is also why FDA never publicly named anyone in the 89-person romaine outbreak of 2024, #1280, which hospitalized 36 people and killed one.

FDA has not always treated a missing product as a reason to keep the source quiet. In at least eight outbreaks since 2006, FDA or CDC named the farm, processor or brand after the food was past its shelf life or out of commerce. Each example links to a source you can check.

2006: Dole spinach. A processor, four ranches, the grower and the harvesters, named in the final report

The outbreak was over, and the spinach had been recalled for six months, when FDA and California released their final report in March 2007. The outbreak sickened 205 people and killed three. The report, co-written by FDA’s San Francisco District, names Natural Selection Foods as the processor and the Paicines Ranch in San Benito County as the one where the outbreak strain was found, and names Mission Organics as the company that farmed the field. It also names the growers and harvesters of three other fields that did not match, and the maker of the fertilizer used at Paicines.

2013: Taylor Farms de Mexico. Named after Iowa and Nebraska said the salad was gone

In an August 2, 2013 statement, FDA named Taylor Farms de Mexico as the common supplier behind restaurant illness clusters in Iowa and Nebraska, after health officials there said the salad mix was likely out of the food supply. The last illnesses in those states were July 2, and salad mix lasts about two weeks. An FDA spokeswoman identified the restaurants to CNN as Red Lobster and Olive Garden. Bruce Taylor told NBC News the company’s tests had all been negative.

April 2018: Harrison Farms. Named by CORE’s own director after the season ended

The director of FDA’s Coordinated Outbreak Response and Evaluation Network, the office that closed #1382, named Harrison Farms of Yuma as the source of whole-head romaine that sickened eight people at an Alaska correctional facility. FDA said the farm’s romaine was harvested March 5 to 16 and was past its 21-day shelf life, and the farm was growing grass. The wider Yuma outbreak was still open, and FDA later said it could not be explained by a single grower.

July 2018: Fresh Express and Caito Foods. Named after the salad mix and wraps expired

FDA announced that it had confirmed Cyclospora in an unused package of salad mix processed by Fresh Express in Streamwood, Illinois, for McDonald’s. The package’s July 19 expiration date had passed, and Fresh Express said romaine from the same lot had also expired. USDA’s Food Safety and Inspection Service then named Caito Foods and retailers including Kroger, Trader Joe’s and Walgreens for salads and wraps made with that romaine, all dated July 18 to 23. FDA itself declined to name Fresh Express’s other customers, citing confidential business information.

December 2018: Adam Bros. Farming. A romaine farm named after its romaine was off the market

FDA Commissioner Scott Gottlieb and Deputy Commissioner Frank Yiannas announced that the outbreak strain had been found in sediment in an irrigation reservoir on a farm operated by Adam Bros. Farms in Santa Barbara County. They confirmed the farm had not shipped romaine since November 20. They reported that records from five restaurants in four states pointed to 11 distributors, nine growers and eight farms, with no single establishment common to every supply chain. CDC’s final notice says the farm’s romaine linked to the outbreak was no longer for sale.

2021 and 2022: Three brands named after their dates had passed

In November 2021, FDA identified Josie’s Organics Baby Spinach after Minnesota found the outbreak strain in a package from a sick person’s home. Its best-by date, October 23, had passed before CDC told people not to eat it. On December 30, 2021, CDC named Simple Truth Organic and Nature’s Basket Organic Power Greens, and Washington health officials told people to discard packages with best-by dates through December 20. FDA later reported that traceback reached farms in Yuma and Salinas without a single production code. In May 2022, FDA named FreshKampo and HEB fresh organic strawberries in a hepatitis A outbreak while saying the berries were past shelf life. The strawberry advice concerned frozen berries and vaccination after exposure.

USDA does this as a matter of routine

When meat or poultry is no longer for sale, USDA’s Food Safety and Inspection Service issues a public health alert instead of a recall, and it names the company. In April 2024, for example, it issued an alert namingGreater Omaha Packing for ground beef that may have carried E. coli O157:H7, stating that a recall was not requested because the product was no longer available. FSIS typically notes that product may still be in freezers.

What FDA disclosed when it did not name anyone

Frank Yiannas served as deputy commissioner from December 2018 to February 2023. On October 31, 2019, FDA announced a 23-person romaine outbreak that had already ended, with the romaine past its shelf life when it was identified, which is the #1382 situation. FDA still listed cases in each of twelve states, eleven hospitalizations and onset dates. It said investigators sampled central coast California farms identified in traceback, did not find the outbreak strain, and did not identify a common source. FDA said it was sharing the details to ensure “full awareness by the public.” The Washington Post reported that the agencies had settled on romaine on October 2. In the fall 2019 Salinas outbreaks, FDA said traceback found a common grower and at least ten fields and never named the grower. In both cases the public learned whether traceback converged. The #1382 closure does not say.

Not random. Ungoverned.

Only the 2006 report came after an outbreak had fully ended. In the other seven, part of the investigation was still open, and FDA could say the name served that investigation. Side by side, these cases can look random, but they are not quite that. A few things predict when FDA names a company: a positive lab sample, as with Adam Bros., Fresh Express, Josie’s and the 2006 spinach; a consumer brand rather than a grower, which is why Josie’s was named and its farms were not; and something the public can still do, such as check a freezer or get a vaccine.

None of those factors holds up. FDA named Harrison Farms on traceback while saying it had not determined how the lettuce was contaminated. In #1280, traceback led to one processor and one grower, and FDA named neither. In 2019, FDA disclosed a common grower in Salinas and kept the name. In 2006, it named companies whose fields came back clean.

I can find no published FDA standard for naming a company once product is off the market, and the reasons change with the case: in 2019 it was the absence of actionable information for consumers, in 2025 it was product people might have frozen, and in 2026 it was shelf life. A decision made without a rule can be neither predicted nor reviewed.

The fix is a written rule. When traceback converges on a single grower or processor, FDA should name it, whether or not product remains on the market. At every closure, FDA should publish the states with cases, the hospitalizations, and whether traceback converged at all.

What this means for #1382 and #1280

In #1280, FDA released a traceback summary with the processor and grower blacked out, then released it in stages without redactions. It shows a single processor and a single grower, Taylor Farms of California and Anthony Costa & Sons. Taylor Farms has denied that its product was the source. In #1382, FDA’s closed row shows traceback and no FDA inspection, sampling or recall, and FDA has not said whether traceback led to one grower or many. I am asking FDA and CDC for the #1382 records under the Freedom of Information Act, and I will report what comes back.

Why transparency and disclosure matter

I have made this argument since 2011. A name is not a punishment. It is the only thing that lets a consumer, a buyer, a regulator or a juror connect this outbreak to the last one. Withhold it, and every outbreak arrives looking like the first one anybody has ever had. The 2021 romaine E. coli O121 outbreak and #1280 both closed without a name, and both were later tied to Taylor Farms through records obtained afterward.

Silence also shifts the cost onto companies that did nothing wrong. During this summer’s Cyclospora outbreak, 6.5 million households stopped buying salad mixes and kits in a single month. When an agency says “romaine” and stops, every romaine grower shares one company’s outbreak, and no buyer can weigh a supplier’s history kept in a sealed file.

An outbreak with no name also teaches nothing. The 2018 Adam Bros. reservoir finding which FDA laid out in a report on the fall 2018 outbreak, and the 2006 Paicines Ranch report gave every grower something concrete to act on because investigators could say where. A closure that says only “romaine” gives them nothing.

The name is also the incentive. As I wrote in 2012, bad publicity is expensive, and poisoning your customers is more expensive. Silence whenever the lettuce is gone removes that incentive from produce outbreaks, which are often solved only after the lettuce is gone.

Federal officials are poised to declare the end of the largest known Cyclospora outbreak in the history of the United States. I did not learn that from CDC or FDA. As I write this, CDC’s own outbreak page, stamped September 3, still lists the investigation as open. I learned it the way the country has learned a good deal about this outbreak, from a newspaper. Two people familiar with the matter, speaking on condition of anonymity, told Rachel Roubein of the Washington Post this afternoon that the announcement could come as soon as today, though the timing is not guaranteed. The Department of Health and Human Services did not comment. 

It is not the first time the explanation went to a reporter before it went to the public. When people asked why FDA waited nearly a month after naming Taylor Farms to send investigators into the fields in central Mexico, the answer came from Donald Prater, FDA’s acting deputy commissioner for food, in an earlier interview with the Post. The agency, he said, first worked to reconstruct conditions during growing and harvest so it could put its resources where they would count. That is a reasonable answer. It belongs on the agency’s outbreak page, where anyone can read it.

The outbreak count stopped. The counting did not.

The outbreak FDA and CDC attribute to iceberg lettuce from Taylor Farms de Mexico stands at 11,458 illnesses in twenty states, at least 495 hospitalizations and two deaths in Michigan, with onsets from June 14 through August 15. Neither agency has changed that number since August 27, and on September 3 CDC said it would stop updating that page weekly.

The national count kept going. On September 8 CDC reported 19,595 laboratory-confirmed cases of cyclosporiasis acquired in the United States since May 1, with 1,043 hospitalizations, in forty-nine states and the District of Columbia, against 1,180 for the same stretch of 2025. One week earlier the figure was 18,445. CDC also lists 9,355 laboratory-confirmed cases still being sorted into domestic or travel-acquired, and at least 6,149 more that are not laboratory confirmed or are waiting on a patient interview. The agency’s own page says reports take about six weeks to arrive and that it will keep finding cases after the season’s August 31 close. Michigan alone reported 14,718 cases and 366 hospitalizations as of September 3.

Subtract the outbreak from the national count and 8,137 laboratory-confirmed illnesses sit outside the lettuce outbreak with no food named. The two figures carry different dates, so treat that as approximate, but it is not small. The Post said it plainly: nobody has identified the source of those other outbreaks. Declaring the lettuce outbreak over does nothing for those people.

Over is a statement about the calendar, not the cause.

When CDC calls an outbreak over, it is making an epidemiological statement: new illnesses tied to the source have stopped arriving. It is not a finding about how the parasite got onto the lettuce. FDA says that work is ongoing, and I take the agency at its word. But I have watched how these end. In September 2020 CDC declared the Fresh Express bagged salad Cyclospora outbreak over, and FDA’s page still says the cause or source was not determined. In 2013 FDA let Taylor Farms de Mexico reopen its plant on the company’s commitment to test its products and water supply for the parasite, and thirteen years later I cannot find one public result. Today FDA also closed a fourteen-person E. coli O157:H7 outbreak on its outbreak investigation table, naming romaine lettuce and nobody who grew or processed it. An outbreak can be over while the question stays open for good.

Congress asked. Nobody has answered.

Between July 14 and August 13, members of the House and Senate sent thirteen letters about this outbreak to HHS, FDA, CDC and twice to the chief executive of Taylor Farms. Eight set a deadline. All eight have passed, the last on August 27. As of this afternoon I cannot find a published answer to any of them, and I cannot find a hearing noticed in any committee. I laid out that record yesterday. Nothing in it has changed, except that HHS now has one more question it declined to answer, this time from a reporter.

What I have proposed, and who has answered.

I have not just complained. Since July I have put specific fixes on the record, and each of them can be done with authority and tools that already exist.

Test agricultural water for the parasite itself. The generic E. coli testing the industry relies on does not tell you whether Cyclospora is present. FDA has had a validated laboratory method for finding the parasite in agricultural water since 2020. Growers in regions with a Cyclospora history should be using it, and the results should be public.

Put the traceability rule back on a calendar. Congress used Section 780 of last November’s continuing resolution to bar FDA from spending money on enforcing the Food Traceability Rule, whose compliance date had already slid to July 2028. The Consumer Federation of America’s review of this traceback found that records the rule would have required within twenty-four hours took nearly two weeks to arrive. Eleven consumer, public health and labor groups have asked Congress to reverse it. Unwind Section 780.

Pay for the people who do the counting and make testing free for people who cannot pay. In Lee County, Florida, a clinic serving mainly uninsured patients told a reporter it had stopped testing for the parasite because its patients could not afford it. A count is only as good as the people who can pay to get into it.

Name the grower and the processor when traceback converges on them, and do it in the outbreak notice, not months later in a lawsuit. And answer the mail or hold the hearing. The Senate Permanent Subcommittee on Investigations held a Cyclospora hearing on imported raspberries in 1998, when the case count was in the hundreds.

None of this is exotic, and none of it needs a new agency. From the agencies that could act on it and the committees that could hold a hearing, I have heard nothing.

I know this kind of fix works because I watched one work. After Jack in the Box, USDA declared E. coliO157:H7 an adulterant in ground beef in 1994. The hamburger cases that filled my practice from 1993 to the 2002 ConAgra recall are now close to zero for my firm. It is the best thing that has happened in food safety in my lifetime, and it happened because somebody with authority decided to use it.

The file I am not closing.

The government may close the book on the lettuce today, or next week. The 8,137 people with no named source are not closed, and neither am I. Over the fall and winter, I will be working with epidemiologists on where those people got sick. When we find something, it will be here, with the documents, the day we have it. Nobody will need two anonymous sources.

On September 10, 2026, the U.S. Food and Drug Administration closed its investigation into a fourteen-person E. coli O157:H7 outbreak, reference #1382, and for the first time told the public what the food was: romaine lettuce. It named no grower, no processor, no brand and no state where anyone got sick. It said the lettuce was past its shelf life by the time investigators identified it, and the Centers for Disease Control and Prevention had declared the outbreak over on July 29. For ten weeks, the only public record of this outbreak was a single row on a federal table that read “Not Yet Identified.”

What FDA’s table said about #1382, week by week

FDA’s Investigations of Foodborne Illness Outbreaks table is the only place this outbreak ever appeared in public. Here is every version of the #1382 row I captured between July and September.

Table versionFood listedCasesOutbreakInvestigation
Week of July 8Not Yet Identified14OngoingActive
August 6Not Yet Identified14EndedActive
August 12Not Yet Identified14EndedActive
September 2Not Yet Identified14EndedActive
September 10Romaine Lettuce14EndedClosed

Source: FDA CORE investigations table, versions captured the week of July 8 through September 10, 2026. FDA posted #1382 to the table on July 1.

The case count sat at fourteen from the table’s second week to the day the file closed. I did not capture every weekly version, but in every one I have, the food column was blank until September 10. I could find no CDC outbreak notice for #1382 at any point, and no news report naming romaine before the closure.

What FDA said when it closed the file

FDA’s closing note says that people who got sick told CDC investigators they had eaten romaine, that epidemiologic and traceback data from CDC, FDA and state and local partners identified romaine as the likely source, and that by then the product “was beyond shelf life.” The closed row shows that FDA traceback was initiated. The inspection box is blank. The sampling box is blank. No recall was initiated. FDA’s own table definitions say the inspection column counts only FDA’s work and that state, and local partners may inspect on their own, so the fair reading is that FDA itself did not inspect or sample, not that no one did.

What the closure leaves out matters as much as what it says. It does not say how many states had cases, how many people were hospitalized, or whether anyone developed hemolytic uremic syndrome. It does not say when investigators settled on romaine. And it does not say whether traceback led to one grower and one processor or fanned out across many.

FDA has answered those questions before

This is not the first time FDA has closed a romaine outbreak after the lettuce was gone. In October 2019, it tied a twenty-three-person E. coli O157:H7 outbreak to romaine after the fact, with the product already past its shelf life. That time, FDA issued a standalone public notice listing cases in twelve states and eleven hospitalizations, with a statement from its deputy commissioner for food policy urging the leafy greens industry to improve traceability.

FDA has also said plainly when traceback did not point to a single source. In the spring 2018 Yuma outbreak, it said the illnesses could not be explained by a single grower, harvester, processor or distributor. In a fall 2020 E. coli O157:H7 outbreak, it said traceback identified no single farm as a common source. The #1382 closure says neither that traceback converged nor that it fanned out.

Will FDA name the grower or processor?

Not on its own, if past practice holds. FDA’s table definitions say that once it closes its response, it will embed an Executive Incident Summary Abstract in the reference number, so a #1382 abstract should appear. It will probably describe the traceback. It will almost certainly not name anyone. Food Safety News reported that the first abstracts named no restaurants, stores or growers.

The abstract for #1339, a 2025 Salmonella outbreak tied to spring mix, shows how it works. It says the traceback legs converged on a supplier and processor of packaged organic salads, and FDA blacks out the name. It blacks out even the number of traceback legs.

Why the 2024 romaine outbreak matters here

I have been writing about #1280 since the fall of 2024. It was an E. coli O157:H7 outbreak tied to romaine that sickened 89 people in 15 states, hospitalized 36, gave seven hemolytic uremic syndrome and killed one. FDA closed it with nothing but “Romaine Lettuce” on its table. During the investigation, FDA said the lettuce blend involved appeared to be past its shelf life.

When FDA first released its traceback summary, the processor, grower and ranch were all blacked out under the (b)(4) exemption. I stayed on the agency, and in stages it unredacted the file. The traceback led to a single processor, Taylor Farms of California in Salinas, and a single grower, Anthony Costa & Sons of Soledad. Taylor Farms has denied that its product was the source.

The shelf-life reason FDA gave in 2024 is the same one it gives now. It was not a good reason then. A best-by date protects no one by the time a file closes. A name lets other buyers question their suppliers, lets the people who got sick understand what happened to them, and gives the grower and processor a public reason to find and fix the problem.

What FDA should say about #1382 now

Four questions can be answered without harming anyone. 

  • Did traceback lead to one grower and one processor? 
  • How many states, hospitalizations and HUS cases were there? 
  • When did investigators identify romaine? 
  • Did any state inspect a farm or a plant? 

If the answer to the first question is yes, the names should be public, exactly as I have argued for #1280.

When the #1382 abstract posts, I will write about what it says and what it blacks out. The history is in my running list of E. coli outbreaks linked to romaine lettuce.

FDA’s internal records on two E. coli O157:H7 outbreaks linked to Raw Farm LLC of Fresno, California, show the agency suspected in February 2024 that Raw Farm was putting milk from cows that had tested preliminary positive for pathogens into its raw cheddar cheese. Two years later, after a second outbreak linked to the same cheese sickened nine people, most of them small children, FDA inspectors documented the practice.

The records, released with Freedom of Information Act redactions, cover CARA #1215, the 2023–2024 outbreak that sickened 11 people in five states, and CARA #1369, the 2025–2026 outbreak, including FDA’s incident logs, closing summaries, a sequencing report, and Health Hazard Evaluations signed in June 2024 and April 2026.

What did FDA know about Raw Farm in 2024?

CDC told FDA’s Coordinated Outbreak Response and Evaluation (CORE) Network about the first cluster on February 9, 2024. It grew to 11 cases in California, Colorado, New Jersey, Texas and Utah. Five people were hospitalized, and two developed hemolytic uremic syndrome (HUS). Seven of the 10 people interviewed reported eating Raw Farm raw cheddar in the week before they got sick, against 4.9 percent in CDC’s FoodNet Population Survey.

FDA’s February 15, 2024, incident briefing says the firm’s own account of its cheesemaking “appears to indicate that the firm uses potentially contaminated milk from cows that have tested preliminary positive for pathogens in their cheese production,” relying on the aging requirement for raw milk cheese. The traceback summary is blunter: “Milk from sick cows was diverted to make raw milk cheddar cheese for both the shredded and block cheeses.” The briefing adds that earlier FDA inspections had found inadequate preventive controls, and that about half of Raw Farm’s cheddar shipped out of state, beyond the reach of the 2010 federal injunction, which covered raw milk but not aged raw cheese.

FDA drafted an assignment to collect shipment and lot code records at Raw Farm itself. It was never issued. The Office of Chief Counsel advised against it “due to ongoing litigation activities and communication challenges with the firm.” The three traceback assignments FDA did issue, to retail and distribution points, were conducted remotely and closed with no Form 483.

Raw Farm recalled certain lots on February 16, 2024. Ten days later it issued a press release withdrawing and concluding that recall. FDA’s consumer advice did not change, and its June 10, 2024, Health Hazard Evaluation found that people who ate the cheese were at high risk of illness that could be fatal. The closing summary concludes, “Although we don’t know how the contamination occurred, Raw Farm-brand Raw Cheddar cheese was determined to be the source of the outbreak.”

How did FDA link the 2026 outbreak to Raw Farm?

CDC flagged the second cluster on March 10, 2026, and named Raw Farm raw cheddar the suspect on March 13. At closure there were nine cases: seven in California and one each in Florida and Texas. The median age was 2. Three people were hospitalized and one developed HUS. All eight people asked reported eating or being served raw milk or cheese, against 6.4 percent in FoodNet, and all seven who knew a brand-named Raw Farm.

The 2026 evaluation explains why cases came in two waves. Three people fell ill in September 2025 after drinking Raw Farm raw milk; the rest fell ill in January and February 2026 after eating Raw Farm cheddar. FDA wrote that milk from the same supply that sickened the first group was likely diverted into cheese without an intervening step, aged, and sold.

What did FDA inspectors find at Raw Farm in 2026?

FDA’s for-cause inspections ran from March 19 into the second week of April 2026, doubling as follow-up under the 2023 Consent Decree, and ended with Form 483 observations at three sites. At the Fowler creamery, FDA found the firm using raw milk that had tested positive for pathogens to make raw cheese and storing raw milk without temperature control. At the Hanford cheese plant, FDA found Raw Farm had never scientifically shown that its aging process controls pathogens, that employees cleaning the processing room spread potential contamination from the floor, and that the firm did not follow its own environmental testing procedures. At the Hanford dairy, FDA saw uncleaned milking equipment, poor hand and glove hygiene, and manure on the teat of a cow being milked.

The incident log adds more. Employees did not change gloves between washing down manure and handling the milking claw. Raw Farm’s pathogen testing protocol did not test its 8-ounce and 16-ounce finished packages, the ones people buy. On the first day of the inspection, Raw Farm reported that it had destroyed seven batches made with positive milk that had tested negative as finished product and had stopped using positive milk for cheese.

Does aging raw milk cheddar kill E. coli?

Not reliably. Federal rules allow cheddar to be made from unpasteurized milk if it is cured at no less than 35°F for at least 60 days. FDA redacted the length of Raw Farm’s aging process. At Hanford, Raw Farm’s own testing found pathogens in cheese that had finished aging, made from milk that first tested negative, which FDA wrote “shows the aging process does not control pathogens in the raw cheddar cheese products.”

The 2026 evaluation names the underlying policy, diverting pathogen-positive milk into cheese without an intervening step, as a contributor to Raw Farm’s outbreaks, because aging “does not guarantee pathogen elimination.” The question was not new; the 2024 briefing notes an earlier FDA outbreak investigation had already asked whether aging eliminates pathogenic E. coli.

Did FDA find E. coli in Raw Farm cheese?

Not the outbreak strain, in either outbreak. In 2026, however, a block of raw cheddar FDA collected at the Hanford plant on March 31 tested positive for a different strain of E. coli O157:H7. Raw Farm said the batch was never distributed. FDA’s April 15 sequencing report matched it to 19 clinical isolates from 2025, three of them within 1 to 8 SNPs, or single-letter genetic differences. Many were tied to a fall 2025 cluster CDC closed without identifying a food. FDA did not count those illnesses in this outbreak because there were no epidemiologic links, and nothing in the released records shows whether those patients were later asked about Raw Farm.

Why did the 2026 Raw Farm recall take three weeks?

The 2026 evaluation lays out the calendar. On March 13, FDA and CDC told Raw Farm its products were linked to the outbreak and asked for a recall decision within 24 hours. On March 14, the firm declined. On March 16, a business whose name FDA redacted issued a recall notice for all Raw Farm raw cheese sold in stores. On March 27, FDA asked again, recommending a recall of all cheese sold or distributed after December 15, 2025. On March 28, Raw Farm asked for more information. It told FDA on April 1 that it would recall, announced the recall April 2, and issued an updated release April 7 covering cheese with expiration dates from May 6 through September 24, 2026.

I wrote in Food Safety News on April 1, while the company was still refusing, that Raw Farm has a long history of outbreaks linked to its products. FDA’s files now tell it in the agency’s own words.

What is Raw Farm’s outbreak history?

My April 1 column traces outbreaks and recalls back to 2006 under Raw Farm and its predecessor, Organic Pastures, including E. coli O157:H7 outbreaks linked to its raw milk in 2006, 2011 and 2016 and to its raw cheddar in 2023–2024 and 2025–2026, and a 2023–2024 raw milk Salmonella Typhimurium outbreak California counted at 171 illnesses. FDA’s 2026 evaluation says the string of recent outbreaks demonstrates “the firm’s systematic potential to produce unsafe fluid raw milk and raw milk cheddar cheese.” Organic Pastures pleaded guilty in 2008 to two misdemeanor counts of introducing misbranded food into interstate commerce, a permanent injunction followed in 2010, and a 2023 Consent Decree gave FDA the right to inspect without notice.

What would have prevented this?

Two rules would have mattered. Milk that tests positive for a pathogen should never become raw milk cheese; Raw Farm told FDA it would stop only during the March 2026 inspection, two years after FDA first wrote down its suspicion. Finished retail packages of raw milk cheese should be tested before they ship; Raw Farm’s protocol did not test them. FDA should write both into its standards for raw milk cheese rather than wait for a third outbreak.

Was Raw Farm raw cheddar cheese recalled?

Yes, twice. Raw Farm recalled certain lots on February 16, 2024, and withdrew that recall ten days later. It recalled its raw cheddar again on April 2, 2026, and expanded the recall on April 7 to cheese with expiration dates from May 6 through September 24, 2026.

FDA Documents

https://www.marlerblog.com/files/2026/09/1369-Records-FInal_Redacted.pdf

https://www.marlerblog.com/files/2026/09/CARA-1215-Records-Final_Redacted.pdf

The seed supplier FDA has declined to name in the alfalfa sprout outbreak that has sickened 55 people in 15 states is International Sprout Holdings, Inc., which does business as International Specialty Supply in Cookeville, Tennessee. My friend Phyllis Entis, the FoodBugLady, found it today in FDA’s weekly Enforcement Report and published it on eFoodAlert: a recall of 43,799 pounds of alfalfa seed from a single lot, ISS Lot # SAL2-24JB, sold in 50-pound bags, which the company began on August 23 by emailing its customers.

That is roughly 876 bags of seed, shipped to wholesale customers in California, Florida, Hawaii, Illinois, Massachusetts, Minnesota, Missouri, Montana, New York, Ohio, Oregon, Pennsylvania, South Carolina, Tennessee, Texas and Utah, plus Puerto Rico, Canada, Mexico, Tahiti and Venezuela. None of those customers is named.

Credit where it is due.

Enforcement Reports are where recalls go when nobody sends out a press release, and it takes someone who actually reads them to find one. Phyllis does. She is a retired food safety microbiologist with degrees from McGill and the University of Toronto, the author of TAINTED: From Farm Gate to Dinner Plate, Fifty Years of Food Safety Failures, and she was writing eFoodAlert before Food Safety News existed. As of this afternoon I could not find the supplier’s name anywhere else. FDA’s outbreak advisory, last updated August 31, still calls it “a common seed supplier,” and CDC’s investigation page has not posted an update since August 24.

The name matters because the seed is the story. I wrote on August 20 that four organisms in one product is a seed signal, not a kitchen signal. FDA’s August 31 update moved the investigation from one sprouter to one seed lot. Today we know whose lot.

What two federal records say, eight days apart.

The Enforcement Report puts the start of the seed recall at August 23, one day after Everything Sprouts recalled its Calco and Everything Sprouts alfalfa. FDA’s August 31 advisory says the supplier told its customers not to use, grow, sell, transfer or redistribute the lot, and to return or dispose of any remaining seed. The same update says the supplier had not responded to FDA’s recall recommendation, had not sent a recall notice to downstream customers, and had not told the customers who received the lot to recall anything they grew from it.

Both can be true. Pulling seed still sitting in a warehouse is one thing. Recalling sprouts already grown from that seed and already sold is another, and that second step is what FDA asked for. On August 31 I wrote that “has not responded” is not the same as “refused,” and the Enforcement Report bears that out: the company acted on the seed itself within a day of the Everything Sprouts recall. What the public record still does not show is a recall of sprouts grown from lot SAL2-24JB by anyone other than Everything Sprouts. FDA says at least one other grower sprouted it. That grower has not been named, and no second sprout recall has been announced.

Where the seed went, and where people got sick.

Setting the seed list next to CDC’s illness map is worth doing, with care. Five states appear on both: Florida, Minnesota, New York, Pennsylvania and South Carolina. Minnesota is Everything Sprouts. Florida and New York each have two reported illnesses, and Pennsylvania and South Carolina one each. Whether those six people ate sprouts grown near home from this lot, or ate Everything Sprouts product while in the upper Midwest, is something FDA’s traceback can answer and the public record cannot.

Eleven states received the seed and have reported no illnesses: California, Hawaii, Illinois, Massachusetts, Missouri, Montana, Ohio, Oregon, Tennessee, Texas and Utah. Wisconsin, with 17 cases, is not on the seed list at all, which fits a Minneapolis grower shipping sprouts across the state line. Two caveats travel with that comparison. The seed went to wholesale consignees, who may have resold it elsewhere, and CDC’s states are where sick people live, not where they ate. CDC also says the true number of sick people is likely much higher and may not be limited to the states with known illnesses.

The Produce Safety Rule covers the sprouter, not the seed.

When FDA finalized its guidance on seed for sprouting in 2022, it counted 52 sprout outbreaks and more than 2,700 illnesses between 1996 and 2020, and said seed has historically been the likely source in many of them. In the same notice FDA said seed for sprouting is food but is not covered produce under the Produce Safety Rule, so growing, conditioning and distributing it are not subject to that rule’s requirements. The guidance is a recommendation. The sprout-specific requirements apply to the grower, and FDA sent Everything Sprouts a warning letter under that rule in March 2025. What FDA has written specifically for the seed supplier, the company that sells to sprouters in 16 states and four countries, is guidance.

Three questions for International Sprout Holdings and FDA.

Who is the second grower, where did it sell sprouts grown from lot SAL2-24JB, and has it recalled them?

The company says on its own website that it grows and tests all of its seed in-house. What did the testing of lot SAL2-24JB show before it shipped?

A local business listing says the company also sells fresh sprouts to distributors, grocery stores and restaurants. Were any of them grown from this lot?

What to do.

The recalled Everything Sprouts products, Calco and Everything Sprouts alfalfa plus the Crunchy Protein, Zesty Garlic and Robust Radish mixes, are listed with lot numbers on FDA’s advisory. Sprouts grown from this seed lot by anyone else carry no recall notice, so there is nothing on the package to check. If you ate sprouts this summer and got sick with diarrhea, especially bloody diarrhea, see a doctor and ask for a stool test. Keep any packaging or receipt, and ask the lab or health department to preserve your isolate, because genetic sequencing is what ties one person’s illness to an outbreak.

Phyllis closed her post with the FoodBugLady’s standing advice: “DO NOT EAT RAW SPROUTS!” I have been saying the same thing for years. Thank you, Phyllis.

Thanks to Cara Lynn Shultz at People for going back to this one. She picked the right date. September 9 is not the day people got sick at the Washington County Fair — that had already happened. It is the day the laboratory proved why.

A week in August

The Washington County Fair ran from August 23 to 29, 1999, in Greenwich, New York, northeast of Albany. About 108,000 people came through the gates that week.

On September 3, the New York State Department of Health got reports of at least ten children hospitalized with bloody diarrhea or E. coli O157:H7 infection in counties near Albany. Every one of them had been to the fair. An environmental investigation of the fairgrounds went out the same day. Most of the fair was supplied with chlorinated water. But in at least one area, a shallow well — Well No. 6 — supplied unchlorinated water to several food vendors, who used it to make beverages and ice. The first cultures from that well came back with high levels of coliforms and E. coli. Officials believed a rainstorm on August 26 had washed cow manure into it.

September 9

On September 9, the New York State Public Health Laboratory — the Wadsworth Center — ran five different polymerase chain reaction assays and demonstrated E. coli O157:H7 DNA in water from the well. Wadsworth then isolated the organism itself, from the well and from the water distribution system. Pulsed-field gel electrophoresis showed that the DNA fingerprints from the well, from the distribution system, and from most of the patients were the same.

The epidemiology matched the lab. In a case-control study of 32 case-patients and 84 controls, 26 of 32 cases had consumed water from the suspect well during the last four days of the fair, against 9 of 57 controls — a matched odds ratio of 23.3, with a 95 percent confidence interval of 6.3 to 86.9. When water consumption was controlled for, eating food at the fair and contact with manure were not significantly associated with illness. It was the water. See the CDC’s Public Health Dispatch of September 17, 1999.

What the numbers actually are

The MMWR figures were preliminary and are still the ones most often quoted. As of September 15, 1999: 921 people reported diarrhea after attending the fair; stool cultures yielded O157:H7 from 116, thirteen of them co-infected with Campylobacter jejuni; 32 more yielded Campylobacter alone; 65 people were hospitalized; 11 children developed hemolytic uremic syndrome; and two people died — a three-year-old girl and a 79-year-old man, she of HUS, he of HUS with thrombotic thrombocytopenic purpura. Illness was reported from 14 New York counties and four states.

The count that has held up is 781. CDC’s review of 350 O157 outbreaks from 1982 through 2002 put the Washington County Fair at 781 ill persons, 9 percent hospitalized, HUS in 2 percent, two dead — still the largest waterborne E. coli O157:H7 outbreak reported in the United States. Wadsworth’s own 2003 paper in the Journal of Clinical Microbiology reported O157:H7 isolated from 128 of 775 patients with suspected infection, and C. jejuni from 44.

Larger numbers circulate — 2,800 turns up in a county planning document — but those are estimates of how many people were probably exposed and probably sickened, not counted cases. Use 781 and say what it is.

What the state did next

On September 13, four days after the lab confirmation, the state health commissioner issued an order requiring county fairgrounds to use disinfected water when hosting public events and began reviewing the laws and regulations that applied to fairs. Letters went to schools and day care centers about excluding symptomatic children and handwashing, and to nursing homes and hospitals about employees and residents with diarrhea. That is what a competent public health response looks like. It came two weeks after the fair closed.

And then the fairs kept going

Well No. 6 was capped and the water rule changed. What did not change is that fairs put small children and ruminant animals in the same square acre, and the pathogen does not care whether it arrives by ice cube or by hand. A partial list from the years right after: Medina County, Ohio in 2000; the Wyandot County Fair in Ohio in 2001, with 92 cases; the Lane County Fair in Eugene, Oregon in 2002, at least 82 ill and 22 hospitalized, the largest E. coli outbreak in Oregon history at the time; the Fort Bend County Fair in Texas in 2003, where the rodeo and animal exhibition areas were saturated with O157:H7; the North Carolina State Fair in 2004, with 108 cases; the Cleveland County Fair in North Carolina in 2012, 106 reported ill; and the San Diego County Fair in 2019, where two-year-old Jedidiah King Cabezuela died of HUS after visiting the animal areas. There are dozens more at fair-safety.com.

None of this is a surprise to anyone who has looked. A 2003 study of livestock at 29 county fairs and three large state fairs isolated E. coli O157:H7 from 13.8 percent of beef cattle, 5.9 percent of dairy cattle, 3.6 percent of pigs, 5.2 percent of sheep and 2.8 percent of goats. The prize animals carry it too.

What should be true at every fairgrounds in America

All water used for drinking, ice, beverages and food preparation comes from a disinfected, tested, monitored supply. No shallow, unregulated well serving vendors, ever.

Handwashing stations with soap and running water at the exits of every animal contact area — not hand sanitizer alone, which does not do the job on soiled hands.

No food, drinks, bottles, pacifiers, sippy cups or strollers in animal contact areas.

Signs people can actually read, at the entrance and the exit, and staff whose job it is to enforce them.

A written agreement between the fair board and every animal exhibitor that says, in plain terms, who is responsible for each of the above. When no one has written it down, everyone points at everyone else afterward.

Twenty-seven years. The three-year-old girl who died would be in her thirties now. The eleven children who went into kidney failure are in their thirties and forties, and some of them are still seeing a nephrologist. That is what these anniversaries are actually about.

FDA and CDC both posted pages today on the broccoli sprout outbreak that Washington, Montana and Idaho have been working since the beginning of the month. FDA’s advisory and CDC’s investigation notice put the count at twenty-two people in four states — Idaho, Montana, Utah and Washington — with two hospitalizations and no deaths. Illnesses began between July 7 and August 26. Of the nineteen people interviewed, all nineteen reported eating sprouts and seventeen named broccoli sprouts specifically. The grower is Evergreen Fresh Sprouts, LLC of Moyie Springs, Idaho.

Six days ago, the public number was sixteen, in three states, with no recall. All three of those things have changed.

The count moved from sixteen to twenty-two, and the last onset moved eight days later.

On September 2 the Washington State Department of Health reported thirteen Washington cases with onsets from July 7 to August 18, plus two in Montana and one in Idaho. Montana’s health department said the next day that it expected its own count to climb once additional laboratory testing finished. It did. The national count is now twenty-two, Utah has appeared for the first time, and the last illness on file began August 26 rather than August 18.

CDC gives the demographics: ages two to eighty-seven, median forty-eight, roughly even between men and women. A two-year-old is on that list. And the August 26 onset is a floor, not a ceiling — it takes three to four weeks to tie a new case to an outbreak, so the last two weeks of illnesses have not been counted yet. Seventeen of nineteen interview subjects naming broccoli sprouts is a very strong signal against a background of well under ten percent of the general population eating any sprouts at all in a given week.

A state lab, an unopened bag from a sick person’s kitchen, and a recall four days later.

Here is the sequence, and it is worth reading slowly. Washington posted on September 2. Montana posted on September 3. On September 4, Evergreen Fresh Sprouts began recalling broccoli sprouts — bags and clamshells with expiration dates of 9/7, 9/9, 9/11, 9/14 and 9/16 — on the strength of a positive Salmonellaresult from a sample collected and analyzed by Montana state officials. CDC says what that sample was: Montana investigators picked up an unopened package of broccoli sprouts from a sick person’s home, and whole genome sequencing showed it carried the same Salmonella Bovismorbificans strain that made everyone else sick. The federal pages went up on September 9.

The evidence that ended the argument was a bag somebody still had in the refrigerator, retrieved and sequenced by a state health department. Not a plant sample. Not a federal finding. Three state health departments and their laboratories built this case and they had it built before either federal agency had a page up. That is worth saying out loud, because the people who did it do not get to issue press releases about themselves.

In 2011 and 2014 the product samples never matched. That is what makes this one different.

This is Evergreen’s third outbreak since 2011. In 2011, twenty-five people in five states were infected with Salmonella Enteritidis from alfalfa and spicy sprouts sold under the Evergreen Produce label. FDA warned consumers directly on June 27 that year, a step the agency generally takes only when a company will not recall, and the co-owner told the trade press that recalling would amount to admitting guilt. The company recalled on July 1. In 2014, nineteen people in six states were infected with E. coli O121 traced to raw clover sprouts served at sandwich shops in Washington and Idaho. Twenty-five plus nineteen plus twenty-two is sixty-six people over fifteen years, from one grower.

In both of the earlier outbreaks, epidemiology and traceback identified the grower while the product samples came back negative for the outbreak strain. That is the ordinary shape of a sprout outbreak: the contaminated lot is eaten before anyone thinks to test it, and contamination clusters in a batch instead of spreading evenly through it. This time a sample matched, and the company recalled within days of the result without FDA having to warn the public over its head. Compared with 2011, that is a better response, and I will say so.

The recall reaches forward, not back.

Look at those five expiration dates again: 9/7, 9/9, 9/11, 9/14 and 9/16. Every one of them is this week or next. The illnesses in this outbreak began on July 7 and the most recent one on file began August 26. Raw sprouts have a shelf life measured in days. Every bag that made a person sick in this outbreak was eaten, or thrown out, weeks before this recall existed.

That is not a criticism of the recall. It is what a sprout recall is, and pulling the current run is the right call. It is a reason to be honest about what the recall can and cannot do. It clears the shelves going forward. It does nothing to explain why product coming out of this facility was contaminated in July, in August, and — on the evidence of a positive package with a September expiration date — in September. That explanation lives upstream: the seed lot, where it came from, how it was treated, and whether the spent irrigation water was tested during the runs that made people sick. None of it is public.

One more thing on the distribution. FDA has confirmed shipments to Idaho, Montana and Washington, and says product may have traveled further. Utah has a sick resident and is not on that list. States on a case map are states of residence, not states of exposure — a Utah patient may well have eaten sprouts on a trip — but it is a live question whether the distribution list is complete, and it is the sort of question a recall is supposed to answer.

The last federal inspection was in 2024, and nobody outside FDA can see what it found.

Phyllis Entis, who has been ahead of the agencies on this outbreak from the start, pulled Evergreen’s inspection record. FDA has inspected this company repeatedly since 2010. The inspection that followed the 2011 outbreak produced a formal warning letter. Most of the ones since, including the 2014 inspection carried out during that outbreak, were classified Voluntary Action Indicated, meaning the agency found things it wanted fixed but left the fixing to the firm. The most recent inspection was in 2024, also Voluntary Action Indicated, with no summary of the observations posted to FDA’s inspection database.

A company with two outbreaks behind it gets inspected, gets a classification that leaves correction to the company, and the public record stops there. FDA has the inspection report. The state epidemiologists who spent August chasing this strain did not have it in front of them, and neither did anyone buying a clamshell of sprouts at a co-op in Bellingham. That is a design problem in how inspection results are published, not a failure by the investigators who did the inspection.

What to do this week, and the three questions I would put to FDA.

If you have Evergreen Fresh Sprouts broccoli sprouts in the house, in a bag or a clamshell, throw them out or take them back, and wash whatever they touched with hot soapy water. Raw sprouts are grown in exactly the warm, wet conditions bacteria like, which is why they remain one of the few foods I tell people flatly to keep away from children under five, adults over sixty-five and anyone whose immune system is compromised. Cooking them is the only step that reliably works.

If you got sick, keep the package or a photograph of it and the receipt, and ask your laboratory or health department to preserve your isolate. Sequencing is what connects one person’s illness to an outbreak strain, and isolates are routinely discarded. We keep a running page on the Evergreen Fresh Sprouts broccoli sprouts Salmonella outbreak, and Food Safety News has been covering it as well.

The three questions: What seed lot produced these sprouts, and who supplied it? Did any of that seed go to another sprouter — which is exactly what traceback turned up last month in the alfalfa sprout outbreak that is still running, separately, in fifteen states? And what did the 2024 inspection find?

Two sprout outbreaks, two growers, one season, fifty-five sick in one and twenty-two in the other. The agencies are right that they are unrelated investigations. They are not unrelated problems.

On August 31, 2026, Abbott announced Similac 360 Total Care Made With Whole Milk, the first and only commercially sterile, ready-to-feed liquid infant formula made with whole milk sold in the United States. Whole milk for a fat blend closer to breast milk, five human milk oligosaccharides, priced near the per-feeding cost of the powder. As launches go, unremarkable.

The frequently asked questions at the bottom are not. Asked what commercial sterility means, Abbott answers that while all formulas, powders included, are made to eliminate potentially harmful microorganisms, commercial sterility means the liquid has gone through an additional, validated heat treatment designed to eliminate spores of potentially harmful microorganisms, particularly Clostridium spores. Asked why liquid is safer for certain babies, Abbott says FDA and CDC advise parents of infants under two months, and of those with weakened immune systems, to consider a commercially sterile liquid when the baby is not receiving breast milk.

I would have skimmed past that. Dr. Jade Cobern’s piece for ABC News pulled the sterility language out of the release and set it beside the two infant botulism outbreaks. Cobern is a board-certified pediatrician and preventive medicine physician with the ABC News Medical Unit. Most of the coverage ran the press release.

The record Abbott is selling against

I have set out both outbreaks in full, the 2023 to 2025 ByHeart outbreak and the 2026 Nara Organics outbreak. ByHeart: 48 infants across 17 states, onsets from December 2023 through November 2025, all hospitalized, declared over February 26, 2026. Nara: four confirmed cases in California, Pennsylvania and Washington, onsets April and May 2026, all hospitalized, declared over August 27, 2026. Fifty-two hospitalized babies. FDA’s closeout reports that one clinical isolate from a Nara infant matches a clinical isolate from a ByHeart infant, a ByHeart base powder sample, and four samples of unopened cans of ByHeart formula. Traceback put the Nara lots on milk supplied by Organic West Milk and spray dried by Dairy Farmers of America, the same suppliers behind ByHeart. FDA still cannot say whether the milk was contaminated before drying or during it.

Where the preparation advice runs out

Abbott’s answer rests on advice about preparing powder carefully for the youngest infants. That advice was written for a different hazard. The joint FAO/WHO expert meeting in June 2026 added botulinum neurotoxin-producing clostridia to the priority hazard list for powdered formula and concluded that current consumer preparation recommendations, designed for Salmonella and Cronobacter, may not be effective against these spores. FDA’s post-outbreak page draws the same line: Cronobacter and Salmonella do not form spores and are killed by pasteurization, while a Clostridium spore survives it. The retort that makes a liquid commercially sterile is the one step here built for a spore.

The wrong test, twice

Nara’s August 27 update closes by reporting that FDA’s tests on sealed cans came back negative for C. botulinum toxin types A and B. Infant botulism does not work that way. The baby swallows spores and the toxin is made in the infant’s intestine, not in the can. A toxin assay on a sealed can is the wrong test.

The screening test fares no better. Nara’s supply chain page reports every batch at or below 10 CFU/g for sulfite-reducing clostridia, the limit of detection. The peer-reviewed analysis of the ByHeart product found C. botulinum in finished formula and in base powder where that same indicator was non-detectable, and concluded that indicator screening would not have prevented the outbreak even had it been in place. The numbers are in the industry’s own report. ByHeart ran roughly 5,000 C. botulinum tests through IEH Laboratories and disclosed nine positives across 4,675 samples, eight of 241 finished-product lots positive by PCR, and one confirmed positive ingredient, organic whole milk powder from Organic West sampled at Dairy Farmers of America. Every one of those positive samples read under 10 cfu/g on the sulfite-reducing clostridia test. Nara’s reassuring number and ByHeart’s positives are the same number.

Nobody assessed the ingredient. FDA named the hazard anyway.

Ask why the screening was so thin and the trail runs back twenty years and stops. A 2004 joint FAO/WHO expert meeting classified C. botulinum as capable of causing illness in infants but did not identify it as a hazard in powdered infant formula. Because of that, the organism is not treated as a hazard in the 2008 Codex Code of Hygienic Practice for powdered formulae. The one real risk assessment was British and ad hoc, done in 2006 after a UK case, and it concluded the risk was low on the strength of production hygiene and a low calculated spore prevalence. In 2014 ICMSF built on the 2004 finding and recommended sulfite-reducing clostridia enumeration as a general indicator instead of routine testing for C. botulinum. That is the document FDA has now asked ICMSF to revisit.

Not one link in that chain examines whole milk powder as an ingredient with its own hazard profile; it is all dairy-based ingredients generally, on a 2004 premise. Meanwhile the ingredient changed. Formula historically used a skim milk protein base with a vegetable oil blend; whole milk powder is a recent premium ingredient sold on being closer to breast milk. No one asked publicly whether that switch changed the spore picture, and FDA did not sample whole milk powder as a category until February 2026. In March 2026 I listed the missing work: prevalence studies on dairy powders including whole milk powder, and the impact of farming practices including spores in silage and bedding. The Nara infants got sick three months later.

None of which excuses anyone, because FDA had already said it in writing. Its Call-to-Action letter of March 8, 2023, sent to every manufacturer, packer, distributor, exporter, importer and retailer of powdered infant formula in the country, told the industry there were other “known or reasonably foreseeable biological hazards” in this product beyond Cronobacter. It reported that the agency had already investigated complaints involving Cronobacter infections, Salmonella infections and infant botulism cases among infants fed powdered formula from a variety of manufacturers. Then it named the organism: historical associations between powdered infant formula and Cronobacter, Salmonella and Clostridium botulinum should be considered when designing and implementing controls. The earliest illness onset in CDC’s final ByHeart case definition came nine months later, on December 24, 2023. I wrote about that letter in June, and it is the document that ends the foreseeability argument.

The customer list

Organic West Milk has never posted a statement. Its only public words are from an owner, Bill Van Ryn, to the Associated Press in January: that nothing had been proven about the milk, and that Organic West sold organic whole milk powder to no infant formula maker besides ByHeart. FDA reports that during the ByHeart investigation Organic West gave the agency an incomplete customer list that did not disclose Nara, and that this year the company told FDA the earlier information should have included the Nara suppliers. Nara’s own page says it bought Organic West milk dried at Dairy Farmers of America from October 2024 to April 2025. Whether the second set of babies had to get sick at all turns on that list.

Dairy Farmers of America told ABC News last month that it is no longer processing milk from or for Organic West Milk. ByHeart’s Action Plan commits to C. botulinum-specific testing of every dairy ingredient and every finished batch before release, an admission that the controls running while 48 babies were hospitalized could not find the hazard. When ByHeart recalled in November 2025, a company Instagram post recommended Nara Organics and offered ByHeart customers a 20 percent discount code, and was later deleted — steering parents fleeing one botulism-linked formula toward another drawing on the same milk.

What is already required, and what is not

FDA’s July 13, 2026 letter to the infant formula industry says the obligations already exist. A supplier of an ingredient that will not receive a lethal treatment at the formula plant is an extension of the manufacturing process. Part 106 requires ingredient specifications, quarantine of nonconforming material and scheduled audits. Part 117 requires a hazard analysis, preventive controls and supplier verification, and a hazard reasonably likely to occur requires a preventive control. What the testing table at 21 C.F.R. § 106.55(e) actually requires anyone to look for is Salmonella and Cronobacter. Nothing else. The international guidance gave the industry a place to stand, FDA knocked it out from under them in 2023, and the agency has now written the industry three letters about this organism without writing a rule.

The industry answered, and paid for the answer

This month the Reagan-Udall Foundation published Applying the Science of Infant Formula Safety, a report on a July 13 roundtable convened with, and funded by, ByHeart and the International Dairy Foods Association. I went through it in detail last week. Twenty-two recommendations, twenty-four contributors, not one of them a parent of the 52 hospitalized infants, and not one recommendation that would require any company to do anything. It is candid in the appendices in a way the recommendations are not: the entry point of the organism into the ingredient has not been established, FDA’s testing workflow is labeled interim pending validation, few laboratories can run the test at all, and the contamination is non-homogeneous and low-level, which means a clean result on any one lot proves very little. Page 15 asks that risk reduction be balanced against supply chain sustainability, because costly controls could cost manufacturers their supply partners.

Which brings this back to Abbott, and to the fact that both halves of this argument live in the same regulation, one paragraph apart. Section 106.55(b) directs a manufacturer of liquid infant formula to comply with Part 113, the rules for thermally processed low-acid foods packaged in hermetically sealed containers — a body of regulation written expressly to keep botulism out of a sealed can. The very next paragraph sends powdered formula to that two-organism table instead. In the decades since, nobody has argued that Part 113 made ready-to-feed unaffordable. A tub of powder gets a letter. Abbott is not inventing anything here. It is charging a premium for a control that liquid has been required to have all along, and that powder has never been required to have at all.

What is left to do

The fix is drafted and sitting in committee. H.R. 7867, the Infant Formula Safety Modernization Act of 2026, introduced March 9 by Rosa DeLauro with nineteen cosponsors, Republican Jeff Van Drew among them, would require standardized pathogen testing of infant formula and of the facilities that make it, and would add C. botulinum to that § 106.55 table. I wrote to the Committee in June supporting it, as have the American Academy of Pediatrics, Consumer Reports, the Center for Science in the Public Interest, STOP Foodborne Illness and the Association of Public Health Laboratories, among others. On April 29 the Senate passed the Protect Infant Formula from Contamination Act, S. 272, which requires testing for Cronobacter or Salmonella and says nothing about this organism. The House Energy and Commerce Health Subcommittee heard H.R. 7867 that same day and has not marked it up since. The Nara babies got sick after that hearing.

Hold the markup. Then hold a hearing with the parents at the witness table, because the members voting on this should hear what a paralyzed two-month-old looks like from the people who sat with one.

And the t-shirts are arriving. Five hundred thirty-five of them, one for every member, each compressed inside a small plastic baby bottle and reading: For Babies’ Sake, Test for Botulism in Infant Formula. Abbott can sell the answer as a premium feature. Congress can make it the floor. If your shirt has not shown up yet, write me. I ordered enough.

The 2026 Cyclospora season closed on August 31. CDC’s national count for May 1 through August 31 is 18,445 laboratory-confirmed domestic cases, 990 hospitalizations, two deaths and forty-nine states plus the District of Columbia, against 1,180 cases in the same stretch of 2025. I went back through four weeks of the public record, August 11 to today, and read what the people who are supposed to answer for this have said. This is the whole of it.

The company answered. It answered on its own website.

Taylor Farms has rebuilt its outbreak statement into a Cyclospora information hub. The page’s own modified date is September 1. The company says it has taken roughly 2,000 samples in central Mexico since May with zero positives, and pairs that with FDA’s position that there are no confirmed positive product tests as of August 27. It says it has suspended all iceberg sourcing from central Mexico for the season and that its leafy greens are now grown in the United States and Canada.

Two of the new questions are answers to charges. Asked whether the company opposes traceability legislation, it calls that absolutely false and says it fully supports the Food Traceability Rule and implemented traceback protocols ahead of the deadline. Asked whether it used political connections or contributions to influence the FDA investigation, it says no and categorically rejects the suggestion.

The third new item is a day-by-day account of July 15 through July 19. The company says FDA and CDC first shared traceback and epidemiologic data on July 15, that it raised questions about the government’s assumptions, methodology and cluster determinations, and that on July 16 those questions were discussed further with government counsel and officials from FDA, HHS and the White House. It decided to recall that day and announced it on July 17.

Read that against the mail. Representative Robert Garcia asked the company for every communication with the White House. Senator Richard Blumenthal asked FDA and the company for all communications with the Executive Office of the President. Neither produced an answer. The company’s marketing site now contains a partial one, with no document attached and nobody under oath.

FDA’s answer was a guidance nobody has to follow.

On August 11 the agency finalized its Guide to Minimize Biological Hazards in Ready-to-Eat Fresh-Cut Produce, with the Federal Register notice on August 12, replacing a draft that had sat since 2018. It is aimed at processors of chopped lettuce, cut melon and diced onions, and recommends sanitation controls, supplier verification and safe water. It names Cyclospora among the hazards, and it notes that antimicrobial wash water may not control this parasite, so supply-chain controls may be needed instead. It is not legally binding.

A Taylor Farms spokesperson told reporters the same week that the company is already in compliance with the final guidance. The acting FDA commissioner went on CNBC that Tuesday to say Americans should feel confident eating leafy greens, and HHS posted that Cyclospora was contained and American food was safe.

The largest Cyclospora outbreak in American history produced a recommendation that the implicated company met before the ink was dry.

Then both agencies went quiet.

FDA updated its outbreak advisory weekly through the summer, on August 13, 20 and August 27, when the count reached 11,458 illnesses in twenty states with 495 hospitalizations, two deaths and a last onset of August 15. Nothing since, twelve days after a weekly cadence. The page still says sampling at the growers and the plant is ongoing. That inspection began August 13. No findings and no Form 483 are public. On August 28 the agency classified the recall Class I and published an explainer stressing that classification is routine and not an escalation.

On September 3, CDC’s outbreak page said it is reducing the frequency of its web updates as new case reports decline, and that updates will no longer happen weekly.

Do the subtraction. The national confirmed count is 18,445 and the outbreak attributed to the lettuce is 11,458. That leaves roughly seven thousand laboratory-confirmed Americans made sick this summer who have never been told what they ate, and the counting is now slowing on both pages at once.

Mexico tested again, and again found nothing.

On August 11 the Quintana Roo state government published COFEPRIS’s finding that every sample from sixteen Riviera Maya hotels, thirty-two of food and eleven of drinking water, came back negative for Cyclospora cayetanensis. That sampling answered a UK Health Security Agency report of sixty-seven cases, forty-eight of them in patients who had been to Mexico. On the lettuce plant, Mexico has said nothing since August 7, when the head of Cofepris said the results do not confirm the hypothesis, that the hypothesis still stands, and that a Mexican origin has not been proven. Two rounds of negative sampling, for a parasite that cannot be cultured and is hard to recover from food or water. That is the expected result, not an exoneration, and the regulator has not called it one.

The trade association moved, and it moved toward the evidence.

The International Fresh Produce Association rewrote its consumer Cyclospora FAQ and stamped it September 4. In July its chief science officer was saying that assigning blame is not the same as identifying a source. The page now asks whether a specific food has been identified and answers yes, at 11,458 confirmed cases in twenty states, and explains that the absence of a positive sample does not make the epidemiological and traceback findings wrong, because the food is usually gone before testing is possible.

The same page carries the 236,192-case recall figure and says nearly half of it went to Walmart for Marketside, with Taco Bell only a fraction. It says the July 18 positive came from routine import sampling, not the recalled product.

Where I part company with them: the Lake Erie hypothesis.

Where the association pushes back, it pushes on the unattributed clusters rather than the lettuce. It raises municipal sewage overflows in the greater Detroit and Toledo region and their effect on well water and on Lake Erie, pointing to combined sewer overflow activity in mid-June, while saying the confirmed subcluster runs through an imported product from central Mexico. I do not think the water story holds, and the reason is the life cycle its own page explains a few sections earlier.

Humans are the only known host, so nothing reaches a sewer in Detroit or Toledo that a person did not shed first. And people shed oocysts unsporulated, not yet infectious, needing one to two weeks in a warm, wet environment before they can make anyone else sick. Put those two facts together and the hypothesis eats itself. For a mid-June overflow to carry Cyclospora in any quantity, a great many people in southeast Michigan and northwest Ohio had to be infected already in late May, and in a country where this parasite is not endemic, they got it from something, which is nearly always imported produce. The theory needs the outbreak to explain the outbreak. If anything, the arrow points the other way, since an outbreak this size is what would put oocysts into those sewers.

The rest of the chain is thin. Documented waterborne cyclosporiasis is rare and mostly foreign: Nepal in 1992 and 1994, a well in Haiti, a rooftop storage reservoir at a Chicago hospital in 1990 and scattered single cases. The 1995 American tap-water cluster is the one usually cited, and no oocysts were ever recovered from the water, with a follow-up study concluding it may have been food after all. Chlorine does not kill this parasite, which the association is right to raise, but an eight-to-ten-micron oocyst is what filtration at a Great Lakes water plant is built to remove, and an overflow discharges into the lake, not into finished water. Cyclospora does not appear in CDC’s recreational water outbreak reporting, where Cryptosporidium dominates. And the map does not cooperate: Michigan’s cases run across more than seventy counties, most nowhere near those sewers, in a season that reached forty-nine states.

Then look at what the theory would have to explain. Michigan counted more than eleven thousand cases across more than seventy counties, and Michigan has two counties on Lake Erie. Detroit does not drink Lake Erie water at all: the Great Lakes Water Authority serves about four million people in roughly 127 southeast Michigan communities from three intakes, one in Lake Huron and two in the Detroit River, every one of them upstream of the lake those sewers discharge into. Ohio counted about four thousand cases statewide, not in the Toledo suburbs. And the season reached forty-nine states and the District of Columbia. Whatever sickened people in Texas, Arizona and Washington did not come out of a combined sewer in Ohio. The calendar does not cooperate either. CDC opens the season May 1, and cases were accumulating well before the mid-June rainfall the association points to, with a median onset of July 8. A regional water event in the third week of June cannot cause illnesses that began in May.

What I do grant is the narrow part of the ask. Adding water questions to the patient questionnaire costs almost nothing, and the seven thousand cases with no food named deserve that work. Granting that is not granting Lake Erie.

Three admissions there are worth keeping. There is no FDA guidance and no validated Cyclospora-specific protocol telling growers how to prevent this, which the association calls a real gap rather than an oversight. Good Agricultural Practices were never validated against this parasite. And on the traceability rule, it says the effect of the delay cannot be quantified but the underlying gap is real. It also proposes an FDA-led root cause task force and says it understands FDA plans one of its own.

The California Leafy Greens Marketing Agreement, by contrast, has said nothing new. Its official news page still shows the July 20 statement as its most recent release, and its last posted article is dated July 23. Through the worst four weeks of the season, the program certifying ninety percent of this country’s leafy greens said nothing.

The bill arrived at the register.

Circana’s fresh foods group laid out the damage in The Packer this morning. Between July 19 and August 23, produce went from steady two percent dollar growth to a six percent decline and has stayed down five to six percent every week since, with fresh salads and leafy greens off twenty-seven percent in dollars. Eighty-three percent of shoppers surveyed said they had changed their behavior, and seven in ten of those named produce. Forty of sixty produce subcategories were down.

The industry has paid for this outbreak at the register, and it is paying for the unfinished investigation too. Meanwhile foreign food-facility inspections fell nearly thirteen percent in fiscal 2025 while imports kept rising.

The consumer groups said it first and said it with documents.

The sharpest thing written about this outbreak in the last four weeks did not come from a company, an agency or a trade group. It came from Thomas Gremillion at the Consumer Federation of America on September 1, under the title Tracing a Monumental Food Safety Failure. Working from the New York Times reporting and from FDA, he lays out the traceback as it actually went. Taco Bell took nearly two weeks to hand over records that would have been due within twenty-four hours under the traceability rule, then declined to name Taylor Farms at all, citing the need to protect confidential commercial information. Taylor Farms then stalled for nearly a week, according to FDA, before identifying the location of the farms in Mexico where the lettuce was grown, and the location description of the harvest farm is one of the key data elements the rule requires inside twenty-four hours. Kroger had already made its suppliers comply, so the recordkeeping existed.

Hold that against the company hub, which says the company supports the rule and put traceback protocols in place ahead of the compliance deadline. Same rule, same outbreak, two accounts, and one of them is sourced to the agency running the traceback.

The Safe Food Coalition got there three weeks earlier. In an August 12 letter to House and Senate leadership, eleven organizations, among them the Center for Food Safety, CSPI, the Consumer Federation, Consumer Reports, the Government Accountability Project, the National Consumers League, Stop Foodborne Illness, UFCW and U.S. PIRG, urged Congress to reverse the freeze on traceability funding, and said the crisis in consumer confidence was caused in part by the company’s failure to give the public information the rule requires in a recall notice. On August 27, Sandra Eskin of Stop Foodborne Illness told NPR what the numbers mean in plain language, that nothing like this has happened before and that people are now watching recalls in a way they did not use to.

Two more facts from the Consumer Federation piece belong in the government column. FDA is investigating nineteen foodborne illness clusters right now, and in a recent meeting with consumer advocates its officials said there have never been more open at once. And the Justice Department unit that used to prosecute food safety cases, the one that brought the Peanut Corporation of America case, was disbanded in April 2025.

Thirteen letters, no answers, and no hearing on any calendar.

Between July 14 and August 13, members of Congress sent thirteen separate letters about this outbreak. Five out of the House and eight out of the Senate. They went to the Secretary of Health and Human Services, to the acting heads of FDA and CDC, and twice to the chief executive of Taylor Farms. Every one was written by a Democrat. Eight set a dated deadline and all eight have passed, the last being Senator Elizabeth Warren’s nine questions, due August 27. I cannot find a published answer to any of them.

There is no hearing. I have checked the committee calendars and cannot find one noticed on this outbreak anywhere, not in House Energy and Commerce, not in House Oversight, not in Senate HELP, not in the subcommittee that funds FDA. The Permanent Subcommittee on Investigations held a Cyclospora hearing on imported raspberries in July 1998, when the case count was in the hundreds. This one is in the tens of thousands, with two dead, and nobody has booked a room.

A letter creates a date on which somebody either answered or did not. Thirteen times this summer, the answer was did not. A subpoena creates an appearance. After eight expired deadlines, that is the difference that matters.

Four questions for whoever finally holds the hearing.

Who was in the July 16 meeting, and what was said? The company has told the public that FDA, HHS and White House officials were on that call and that it decided to recall the same day. Congress asked twice and got nothing, and the documents exist. What did the inspection find? FDA has had investigators at the growers and the plant since August 13, and the public has not seen a page of it.

Where did the other seven thousand come from? Those cases sit outside the lettuce outbreak with no vehicle named, and both federal pages have slowed their updates. Over the coming months I will be working with epidemiologists to answer that ourselves, because nobody else is publicly trying. And why was the federal answer a non-binding guidance, when the traceability rule that would have made this traceback faster sits at a July 2028 compliance date?

The season is closed and the counting is slowing. The company has answered in the one venue it controls completely, and its own trade association has moved closer to the evidence than the government has. The room in Washington with a subpoena and an oath in it remains empty.

I read Fast Food Nation before it was a book. Eric and I have known each other a long time, and we talked through parts of Food, Inc. before it was filmed. He has been making the same argument for twenty-five years — that the structure of the meat industry decides who gets sick — and he has been right about it longer than almost anyone writing today. His September 7 guest essay in the New York Times, “Why Did Trump Order Up 660 Million Pounds of Mystery Meat?”, is worth your time.

Five days ago, I wrote about his piece in The Atlantic and turned it into a list of three fights worth having right now — Cyclospora and the traceability rule, botulism testing in infant formula, and Salmonella in chicken. Here is a fourth, and it turns out to be the same fight.

What follows is not a disagreement with Eric. It is the other half. His piece is about labeling, concentration, and how the decision got made. Mine is about the pathogen.

What is actually coming in

The proclamation signed in late August temporarily expands the tariff-rate quota for lean beef trimmings by 300,000 metric tons — about 660 million pounds. The window runs 90 days beginning September 1, capped at 100,000 tons per month, and the effect is to waive the 26.4 percent out-of-quota tariff. Ground beef averaged $6.89 a pound in July.

Eric is right that these are not rib-eyes. They are trimmings — the raw material of hamburger. And that single word is the whole food safety story.

Trimmings are not a detail

E. coli O157:H7 lives in cattle manure and gets onto meat during hide removal. It ends up on the outside surfaces of the carcass, which is exactly what lean trim is. Trim is the highest-risk raw beef component there is, and the entire federal architecture built after 1994 exists because of it: adulterant status for O157 and, later, for six non-O157 serotypes; N-60 excision sampling of trim lots; test-and-hold; and recordkeeping that lets an investigator trace a grinder’s source lots backward.

That architecture reaches imports. FSIS runs a dedicated sampling program for imported beef manufacturing trimmings (MT51), and since February 1, 2023 those samples are analyzed for O157:H7 plus O26, O45, O103, O111, O121 and O145, with Salmonella co-analysis.

I spent from the 1993 Jack in the Box outbreak to the 2002 ConAgra recall doing little else. Hamburger E. colicases are now close to zero in my practice — it is the best thing that has happened in food safety in my lifetime. That did not happen because cattle got cleaner. It happened because the trim gets tested, the lot gets held, and somebody keeps the records.

The one time we actually measured

In March 2017, after Brazilian federal police raided meatpacking plants over allegations that inspectors were being bribed, FSIS put 100 percent reinspection on all Brazilian meat arriving here. The results are public. FSIS refused entry to 11 percent of Brazilian fresh beef — against roughly 1 percent for shipments from the rest of the world — turning back 106 lots and about 1.9 million pounds for public health, sanitary and animal health violations. On June 22, 2017, USDA suspended fresh beef from Brazil altogether. The agency’s own 2017 audit report lists what was being turned away: pathological lesions in raw beef, contaminated beef, off-condition product.

The suspension was lifted on February 21, 2020, after an on-site equivalence verification audit found corrective actions in place. Since then, Brazilian beef has been subject to routine reinspection at ports of entry, like everyone else’s.

Hold those two facts next to each other. “Equivalent” is a finding about a system, made on paper, at a point in time. Routine port-of-entry reinspection is a statistical sample — it is not an inspection of the box that becomes your dinner. The one time we looked at every lot, the failure rate was about ten times the rest of the world’s. We are now inviting up to 100,000 metric tons a month for three months.

Two regulators, one-week, opposite directions

On September 3, the European Commission’s suspension of Brazilian meat, eggs and honey took effect — Brazil was removed from the authorized list because it could not give sufficient guarantees on antimicrobial use in food animals. The American window opened September 1.

I have nothing to add about the White House meetings Eric describes; that reporting is his and Maggie Haberman’s and Jonathan Swan’s, and you should read it there. My point needs no one’s motive. Two competent regulators looked at the same supply chain in the same week and went in opposite directions. Only one of them was looking at it as a food safety question.

What I would ask USDA to do

Not a ban. Four things, all inside existing authority, none of which requires new legislation:

One. Put trimmings entering under the expanded quota at an increased level of reinspection for the full 90 days, rather than the normal sampling plan.

Two. Publish the results monthly — lots presented, lots sampled, lots refused, by country and by foreign establishment. If the beef is as good as we are told, the numbers will say so.

Three. Publish the date and findings of the most recent on-site equivalence audit for every country eligible to ship raw beef here. Consumers are entitled to know how old the paper is.

Four. Confirm on the record that grinder recordkeeping applies with full force to imported source material, and that a source lot can still be identified when a child ends up in a hospital.

The fourth one is the one that decides cases. Eric writes that these grinders combine pieces of tens of thousands of cattle from multiple countries. I have litigated what that sentence means in practice. The only thread running from a sick child back to a slaughterhouse is the grinder’s source-lot record. Every additional foreign supplier makes that thread thinner and the traceback slower — and an outbreak that takes longer to trace is an outbreak that gets bigger.

Two friendly amendments

First, on labeling. I support the Thune–Booker bill to restore country-of-origin labeling, and I have said for years that its repeal in 2015 was a mistake. But be precise about what it buys. A label tells you which borders the meat crossed. It does not tell you whether the meat carries O157:H7. Provenance and contamination are different problems with different fixes. Pass the bill because consumers deserve an honest market — not because it is a control measure, because it is not one.

Second, on the butcher shop. Eric closes by suggesting readers buy American cuts from a local butcher and have them ground on the premises, or grind at home. I understand the impulse, and it does answer the question of what is in the package. It does not answer the safety question. Freshly ground whole muscle from a good local shop has caused outbreaks; I have handled those cases too. Grinding one animal instead of ten thousand narrows how many people get hurt when something goes wrong. It does not make the meat safe. The one thing that makes a hamburger safe is 160°F, measured with a thermometer. Buy from your butcher if you want to know where your beef came from. Then cook it to 160 anyway.

Every item on the list I published five days ago came down to one sentence: finish the rule and put a test in it. Beef is the one place we already did that, and it is the reason those cases left my practice. It would be a strange thing to spend thirty years building that system and then wave 660 million pounds past it because hamburger got expensive.

Eric has spent a quarter century arguing that the shape of this industry determines who gets sick — that consolidation, speed and anonymity are not abstractions but the mechanism by which a pathogen from one animal reaches a thousand people. Six hundred sixty million pounds of anonymous trimmings, arriving in ninety days, into a system that samples a fraction of what crosses the dock, is the newest proof of the thing he has been saying since before most of us were paying attention.