Fifty people are sick with E. coli O157:H7 in an outbreak that the FDA and USDA’s Food Safety and Inspection Service (FSIS) are investigating together as FDA reference #1421 (USDA 2026-04). The government’s public investigation table lists the vehicle as a “Multi-ingredient wrap with chicken (suspect).” Status: active. Ongoing. Under “Recall,” nothing. Under “Public Health Advisory,” nothing.

No retailer. No brand. No manufacturer. No state.

The public did not learn that these were Trader Joe’s Tarragon Chicken Salad Wraps from the FDA or from FSIS. It learned it from a lawsuit. On October 15, my firm filed Gottlieb v. Trader Joe’s Co., No. 2:26-cv-12017, in the U.S. District Court for the Central District of California on behalf of a North Carolina woman who bought her wraps at the Trader Joe’s in Myrtle Beach, South Carolina, and a Massachusetts woman who bought hers at the Trader Joe’s in Allston, Massachusetts.

The genetics now tie my clients together – and to the outbreak

When we filed, the link between my two clients and the outbreak rested on epidemiology: same product, same retailer, same few days, same pathogen, and a North Carolina health department record that lists the source of my client’s illness as a “wrap from Trader Joe’s.” That is how most outbreaks are solved.

Now there is more. Clinical isolates from outbreaks are uploaded to the National Center for Biotechnology Information’s Pathogen Detection database, where whole genome sequences are placed on a public tree. My two clients’ isolates (highlighted in red below) sit in the same tight cluster, alongside roughly forty other clinical isolates collected from late summer through October 20, 2026. The cluster carries the CDC code 2609MLEXH-2. CDC’s case definition for it is an E. coli O157:H7 isolate within zero allele differences by core genome MLST. In plain English: these people were sickened by the same bug, from the same source.

Note the last entry: a clinical isolate collected on October 20, nearly two months after these wraps were sold, and well after the government says the product was past shelf life. Either reporting is lagging badly or people are still getting sick. The public deserves to know which.

What the government knew – and when

Public health records I obtained from the Massachusetts Department of Public Health make clear that federal and state officials knew exactly what this product was, and who sold it, weeks ago:

By mid-September, CDC was reporting 39 cases in 13 states, ages 3 to 87, two-thirds of them women, with roughly one in five hospitalized. Of 21 patients with shopping information, 20 (95%) shopped at Trader Joe’s. Of those 20, 16 (80%) ate a pre-made Trader Joe’s wrap, and 12 of those 16 specifically reported the Tarragon Chicken Wrap, with three more saying they possibly ate one.

Massachusetts officials recorded that, after a call with federal partners, Trader Joe’s pulled the tarragon chicken salad wraps from store shelves in the states that received them and production was halted. The records describe the wraps as coming from a commonly identified contract manufacturer. An FSIS investigator was at a Trader Joe’s in Newton, Massachusetts. A focused questionnaire built entirely around Trader Joe’s wraps and sandwiches was sent to every state. Receipts were collected.

And then this, from CDC’s summary to the states: CDC was “not planning public notification” because the product was past shelf life and no longer available for purchase.

Think about that. The government knew the retailer, knew the product, knew the manufacturer, had receipts and genetic matches – and decided that because the wraps were gone, you did not need to know.

We have done this before – and the government named names

This is not the first time Trader Joe’s has sold E. coli-contaminated chicken salads and wraps. In 2013, 33 people in four states were sickened by salads made by Glass Onion Catering and sold at Trader Joe’s. In that outbreak, CDC named both Glass Onion and Trader Joe’s, and FSIS announced a recall that listed the Trader Joe’s products by name. Same retailer. Same type of product. Same pathogen. Same agencies. Thirteen years later, silence.

Based on what I have learned in this case, I believe the wraps were made for Trader Joe’s by F&S Fresh Foods of Vineland, New Jersey. One of my clients was contacted directly by F&S Fresh Foods’ quality systems staff. Neither FDA nor FSIS has said a word about it.

Why it matters

“Past shelf life” is not the end of the public health story. Wraps get frozen. People who got sick and never connected it to a wrap deserve to know why. Doctors deserve to know what to ask. Other retailers that buy from the same manufacturer deserve to know. And both agencies have said they are still looking for a contaminated ingredient and whether it went into other products. If that ingredient is lettuce, or anything else that went beyond Trader Joe’s, naming the manufacturer is how you find it.

There is also a simple matter of accountability. A company that sells a product that sickens fifty people should not be able to make it disappear by pulling it quietly and calling it a “proactive removal.”

The petition

That is why I am preparing a citizen petition asking FDA to establish, by rule, that the identity of a firm implicated in a foodborne illness outbreak is not confidential commercial information; to disclose growers, processors, manufacturers, distributors and retailers whether or not there is a formal recall and whether or not the product is past shelf life; and, in the meantime, to use the authority it already has under section 705(b) of the Food, Drug, and Cosmetic Act to name names. The Trader Joe’s wrap outbreak is now Exhibit A.

The petition is not yet filed. I am still taking edits and comments, and I welcome them – from public health officials, industry, consumer groups and anyone else who thinks the public has a right to know what made them sick.

Fifty people know. The government knows. Trader Joe’s knows. The manufacturer knows. The only people kept in the dark are the rest of us.

On October 21, 2026, FDA’s outbreak investigation table marked reference #1403, a Salmonella Newport outbreak first posted August 26 with 84 sick, as ended at 119 cases. In 56 days the file never named a food, never drew an on-site inspection, never got an advisory, and never had a CDC notice, so the states, hospitalizations and ages of the 119 are not public. The same update ended an 11-person Listeria file posted July 22 with no food named and started an inspection and sampling in a 46-person Listeria outbreak that still has no food.

The file grew from 84 to 119 in eight weeks and closed with the product line still reading Not Yet Identified.

Here is the whole public life of #1403, taken week by week from FDA’s own What’s New entries. I wrote it up at 116 on September 29 and again on September 30, when it had sat at 116 for a week with sampling marked and nothing else.

Table stampCase countChangeWhat FDA marked
August 2684PostedTraceback initiated
September 297+13Traceback
September 10109+12Traceback
September 16111+2Traceback
September 23116+5Sample collection initiated
October 21119+3Outbreak has ended

Source: FDA CORE investigation table, What’s New entries at each stamp, read October 22, 2026. Check: 13 plus 12 plus 2 plus 5 plus 3 is 35, and 84 plus 35 is 119. August 26 to October 21 is 56 days.

That is a real outbreak. One hundred nineteen culture-confirmed, whole-genome-sequenced SalmonellaNewport infections, which at CDC’s own multiplier of roughly 29 undiagnosed infections for every one counted is somewhere above 3,000 people sick. It grew by a dozen a week through the first half of September, slowed, and stopped. FDA’s note says the outbreak has ended. It does not say why it ended, which is the same as saying nobody knows.

Traceback and sampling were marked; an inspection never was.

The table has four action columns: traceback, on-site inspection, sample collection and recall. For #1403 the first was checked on day one and the third was checked on day 28. The second and fourth were never checked. Traceback without an inspection means FDA had enough food histories to start drawing purchase records back through distributors, and sampling means it tested something, but it never walked a farm, a packinghouse or a plant. That is the sequence you get when the traceback does not converge: the product lists from the sick people point in several directions, no single firm emerges, and the samples come back negative or do not match. It is also the sequence you get when the food is a fresh produce item that was gone from the shelves before the first isolate was sequenced. FDA’s note does not say which.

CDC never posted a notice, so 119 people were counted and nobody was warned.

CDC’s current outbreaks page, re-stamped the same day, lists 18 active multistate Salmonella investigations and names none of them. CDC posts a public notice when it has a food to tell people to avoid; with no food, there is nothing to post, and the 119 people exist only as a number on FDA’s table and in the state health departments that interviewed them. No one outside those agencies knows which states they live in, how many were hospitalized, how old they are, or when the first and last of them got sick. The public record of a 119-person outbreak is one row in a table and six one-line notes.

FDA named a food for Salmonella Newport three times this year, just not this time.

The Closed 2026 section of the same page lists #1366, Salmonella Newport, cantaloupe, 70 sick; #1365, Salmonella Newport and Kentucky, moringa powder; and #1358, Salmonella Typhimurium, Newport and Richmond, moringa leaf powder, which closed at 131 sick in 38 states. Newport is a serotype FDA knows how to find. In 2020 it was red onions, and CDC’s count reached 1,127 people in 48 states. The 2026 file that got away is the largest Newport file on this year’s table.

Seven of the nine no-food files on the table are now marked ended, carrying 573 people.

RefPathogenPostedSickStatusInspected
1392CyclosporaJuly 22241EndedNo
1403Salmonella NewportAugust 26119EndedNo
1387SalmonellaOranienburgJuly 899EndedYes
1417ListeriamonocytogenesSeptember 2346OngoingYes, October 21
1402Salmonella I 4,[5],12:i:-August 1243EndedYes
1385CyclosporaJuly 838EndedNo
1398CyclosporaAugust 522EndedNo
1379ListeriamonocytogenesJuly 2211EndedYes
1415ListeriamonocytogenesSeptember 3011OngoingYes

Source: FDA CORE investigation table, stamped October 21, 2026, rows whose product column reads Not Yet Identified. Check: 241 plus 119 plus 99 plus 46 plus 43 plus 38 plus 22 plus 11 plus 11 is 630. The seven ended rows sum to 573 and the two ongoing rows to 57; 573 plus 57 is 630. Adding the 50-person chicken wrap file, whose product is marked suspect, makes 680.

When I counted this ledger on October 17 it stood at 626 across nine rows with five of them ended. Four days later it is 630 with seven ended. The Listeria file #1379 is the quiet one: posted July 22, standing at nine sick by August, inspected and sampled, inched to 11, and closed October 21 with no food. For Listeria, with its weeks-long incubation and its habit of living in a plant for years, an inspected-and-closed file with no food named is the one that should worry people most, because whatever FDA walked through is still running.

The 46-person Listeria file is the one to watch: FDA is now inside a facility.

Reference #1417 was posted September 23 at 40 sick, went to 44 a week later and 46 on October 15. On October 21 FDA marked an inspection and sampling initiated. An inspection in a Listeria outbreak means traceback produced a firm, and sampling means swabs are being taken off that firm’s drains, floors and equipment. If the swabs match the clinical isolates, FDA will have a food, a plant and a name, and the question will be how long it takes to say them out loud.

FDA should post the Newport abstract now, not after the file moves to Closed.

Last week FDA posted Executive Incident Summary Abstracts for three closed files, including the Midwest Poultry egg outbreak, and those abstracts are the most useful documents on the page: they say what the hypothesis was, what was sampled, where the traceback legs went and where they stopped. For #1403, that document would tell the public what food FDA suspected, how many states were involved, whether the samples it collected were from the suspected food or the sick people’s refrigerators, and why the traceback did not converge. None of that is a trade secret. The outbreak is over; the risk of a premature warning is gone; what remains is the record. Post it while the 119 people are still sick enough to remember what they ate.

Is there a Salmonella Newport recall right now?

No. FDA’s reference #1403 ended on October 21, 2026, with no food identified and no recall or advisory. There is no product to throw out, because FDA never named one.

What food caused the 119-person Salmonella Newport outbreak?

FDA has not said. The product column reads Not Yet Identified, traceback and sampling were marked but no on-site inspection, and CDC never posted a notice. Earlier Salmonella Newport outbreaks have been traced to red onions in 2020 and to cantaloupe and moringa powder in 2026.

What should I do if I have Salmonella symptoms?

See a doctor if you have diarrhea with a fever over 102, bloody stools, vomiting that keeps you from holding liquids, signs of dehydration, or diarrhea lasting more than three days, and ask for a stool culture. A cultured, sequenced isolate is the only way a case gets counted and matched to an outbreak.

On November 6, FDA will hold the second of its public meetings on what it calls Challenges and Solutions in Lot-Level Food Traceability. Anyone who wants to speak must register by October 26, six days from today, and no same-day registration is allowed. Written comments are due December 6 in Docket No. FDA-2014-N-0053. The meeting is billed as a chance to talk about implementation. Read the notice closely and it is something narrower: a conversation about how to make the rule’s core requirement, the lot code, easier to live without.

So here is where the Food Traceability Rule stands, how it got here, and why, more than fifteen years after Congress ordered it, FDA cannot spend a dollar enforcing a single line of it.

What the rule does

Section 204 of the Food Safety Modernization Act, signed in January 2011, told FDA to identify the foods most often tied to outbreaks and to require anyone who manufactures, processes, packs or holds them to keep more and better records. Those foods are on the Food Traceability List: leafy greens, tomatoes, cucumbers, peppers, melons, sprouts, fresh herbs, fresh-cut fruits and vegetables, shell eggs, nut butters, soft cheeses, finfish, crustaceans, some shellfish and ready-to-eat deli salads.

For those foods, the rule requires companies to record key data elements at critical tracking events, harvesting, cooling, initial packing, shipping, receiving and transformation, and to tie them together with a traceability lot code assigned when the food is first packed and carried down the chain. When FDA asks during an outbreak, a covered company must produce an electronic, sortable spreadsheet within 24 hours. FDA estimated the rule would reach more than 323,000 domestic businesses operating about 484,000 establishments, according to the Congressional Research Service.

Before the rule, most food handlers only had to know one step forward and one step back, and farms and restaurants did not have to keep even that. FDA’s own pilot projects, run by the Institute of Food Technologists in 2011 and 2012, found that one-up, one-down records often could not connect the restaurants and grocery stores where people got sick to the farm that grew the food. That is the gap the rule was written to close, and the lot code is what closes it.

The calendar

Congress gave FDA until January 2013 to propose the rule. FDA missed it. The agency did not deliver its report to Congress on the pilot projects until 2016. In 2018 the Center for Food Safety and the Center for Environmental Health sued, and a consent decree set the schedule FDA finally met: a proposed rule on September 23, 2020, and a final rule on November 21, 2022. It took effect January 20, 2023, with compliance set for January 20, 2026. That three-year runway was already a year longer than FDA had proposed, granted because industry asked for it, and at the time FDA said it would go no further. In September 2023 the agency added that it would not begin routine inspections until 2027.

In January 2024 the Government Accountability Office told FDA to finalize and document an implementation plan to hit the 2026 date. Two months later, Rep. Scott Franklin of Florida introduced H.R. 7563, which would have relieved retailers, restaurants and warehouses of the duty to keep and pass along lot codes and required more FDA pilot projects before any enforcement. It never got a vote. Its ideas went into House agriculture appropriations bills instead.

On March 20, 2025, FDA announced it intended to push compliance back 30 months, to July 20, 2028. I wrote at the time that FDA had again kicked the rule down the road. The agency’s stated reason was that even the companies ready for January 2026 depended on supply chain partners who were not, and it said plainly that the extension did not amend, and that it did not intend to amend, the requirements of the rule. The proposed rule to extend the date was published August 7, 2025. As far as I can find, it has never been finalized. It did not need to be.

Congress finished the job. On November 12, 2025, the bill that ended the government shutdown, H.R. 5371(Public Law 119-37), carried Section 780 of Division B, which says no funds appropriated by the Act may be used to administer or enforce the rule before July 20, 2028. The same section told FDA to meet quarterly with farms, restaurants, retailers and warehouses to identify and implement flexibilities for satisfying the lot-level tracking requirement, to give industry guidance on food waste recovery, reclamation, intracompany transfers and customer returns, and to test its own internal tracing system. As I explained in August, that distinction matters. A delay is an agency asking for patience. A funding bar is Congress taking away the agency’s ability to change its mind.

Why it has not been implemented

There are three honest answers, and they overlap.

The first is that part of industry asked for the delay, and its own filings say so. When I went through the federal lobbying disclosures in August, the International Foodservice Distributors Association described its fourth-quarter 2025 work on the rule as support for the 30-month extension and targeted flexibilities. The National Restaurant Association listed H.R. 5371 by number, for provisions regarding FDA traceability, in the quarter it became law. The National Retail Federation reported in 2024 that it sought support for H.R. 7563. Jessica Glenza at the Guardian named Publix among the companies lobbying on the rule.

The members of Congress who carried that ask should be named, because their names are on the record. Rep. Scott Franklin, a Florida Republican who lives in Lakeland, where Publix is headquartered, introduced H.R. 7563 and is vice chair of the House Appropriations Subcommittee on Agriculture, Rural Development, Food and Drug Administration. Rep. Sanford Bishop, a Georgia Democrat, was its lead cosponsor; he is the subcommittee’s ranking member and chaired it in the 117th Congress. Rep. Jimmy Panetta, a California Democrat whose district runs down the Monterey County coast, cosponsored it. And Rep. Andy Harris, a Maryland Republican, chairs the subcommittee whose fiscal 2025 bill and fiscal 2026 bill, H.R. 4121, carried H.R. 7563’s language. The fiscal 2026 version became Section 780. Harris also wrote the fiscal 2027 bill the House passed in June. Two Republicans and two Democrats, three of them sitting where FDA’s money gets written. The bill they introduced died. Its provisions did not; they became law through the one committee where they never needed a hearing, a floor debate or a vote of their own.

The Senate did not go along. In Senate Report 119-37, Senate appropriators directed that FDA may not use funds to delay enforcement beyond July 20, 2028, and that full compliance and enforcement begin by then. Section 780 is a House product.

The second answer is that the industry’s argument is not frivolous, and I should say so. Traceability only works when everyone in a chain is doing it. The 2024 Reagan-Udall Foundation roundtables found low awareness of the rule among small and foreign suppliers and nonchain restaurants, and distributors have real problems with mixed-lot pallets and pick slots. But Kroger, Albertsons and Walmart built programs to the rule before the delay was announced, and Western Growers says its members have collected this shipment data voluntarily for more than a decade. The associations that lobbied for the delay represented the ready and the unready alike. They spoke for the unready.

The third answer is that FDA is not ready either. Section 204 also directed FDA to build an internal system to receive and analyze traceability data. In January 2026 GAO reported that the system still does not exist. FDA told GAO in March 2025 it would be done by January 2026; after the delay, it moved that date to July 2028, too.

What happened while we waited

FDA has now closed its investigation into the largest Cyclospora outbreak in American history: 12,883 confirmed illnesses, 570 hospitalizations and two deaths in 21 states, linked to shredded iceberg lettuce from Taylor Farms de Mexico. Leafy greens are on the Food Traceability List. FDA held its first lot-level public meeting on June 15; CDC puts the first illness on June 14. A Michigan epidemiologist spent the first two weeks of July asking where the lettuce came from. In the meantime, lettuce sales fell, and California growers plowed under healthy crops that had nothing to do with the outbreak. That is what happens when the answer takes twelve days instead of one: the innocent pay for the guilty.

On August 12, eleven consumer, public health and labor organizations in the Safe Food Coalition asked congressional leaders to rescind Section 780. The International Fresh Produce Association says it opposes further delays, and Taylor Farms says it supports traceability legislation. Congress has not acted. The House passed its fiscal 2027 agriculture and FDA bill, H.R. 8646, on June 4 by a vote of 213 to 210, and bill summaries say it carries the same bar on enforcement before July 20, 2028. The Senate has not passed its version.

Where things stand today

On February 19, FDA announced a final exemption for certain cottage cheese, a draft question-and-answer guidance and a series of stakeholder sessions organized by the Partnership for Food Traceability, an industry membership nonprofit. The first session, on March 6, was open only to the partnership’s members.

On October 8, FDA issued draft guidance saying it would not enforce the rule against retail food establishments and restaurants whose average food sales over the previous three years are more than $250,000 but not more than $1 million, adjusted for inflation from 2020. Businesses at $250,000 and under were already exempt. FDA says the new carve-out covers only a small share of food sales while relieving many small operators. Maybe so. It is also the first time the agency has moved the rule’s boundary since Congress told it to look for flexibilities.

And then there is November 6. According to the Federal Register notice and Food Safety Magazine’s summary, FDA wants to hear about a “reasonable range” of traceability lot codes for distributors shipping to retailers; “inferred” lot codes, where a distribution center calculates rather than scans what it shipped; key data elements for individual items no longer in a case; returns and reclamations; food waste recovery; intracompany shipments; retailers that transform food and send it to other stores; and whether industry should settle on a data standard. FDA’s earlier discussion paper and the comments on it are in the docket.

Look at where every one of those topics sits. Distribution centers, grocery stores, restaurants, the back half of the chain, the same link H.R. 7563 tried to cut. The lot code is the rule. A “reasonable range” of lot codes is a range of possible farms, and a range of possible farms is what investigators have today.

Industry, it is your turn

The consumer, public health and labor groups have done their part. Eleven of them signed the August letter. They should not be the only ones asking.

The companies that are already ready have more to gain from this rule than anyone, and they have been far too quiet. So, by name. Kroger, Albertsons and Walmart built traceability programs before the delay was announced; you are the proof that the rule works, and Congress needs to hear it from you. The International Fresh Produce Association says it opposes further delays. Taylor Farms says it supports traceability legislation. Western Growers has already written its members a guidance document on how to comply. The California and Arizona Leafy Greens Marketing Agreements set the food safety rules for the crop at the center of this summer’s outbreak. Put your names on a letter to House and Senate leadership, and to Senators John Hoeven and Jeanne Shaheen, who lead the Senate appropriations subcommittee, asking that Section 780 be rescinded and kept out of the fiscal 2027 bill in conference.

To FMI and the National Grocers Association, which applauded the delay, and to the International Foodservice Distributors Association, the National Restaurant Association and the National Retail Federation, whose filings asked for it: your members include the companies that are ready. Let them speak for themselves on November 6, and do not ask FDA to carve the lot code out of the back half of the chain on their behalf.

And to everyone who grows, packs, ships or sells a food on the list: comply now. Nothing in Section 780 stops a company from keeping lot codes and producing that 24-hour spreadsheet tomorrow. Do it before the 2027 growing season and say so publicly. If the companies already doing this asked Congress to unwind the delay, the argument that industry cannot manage the rule would collapse, because it would be industry saying otherwise. California’s growers learned this summer what it costs when nobody can draw a line around one facility. This rule draws that line.

What I would say on November 6

If you care about this, register to speak before October 26 and file comments by December 6. Here is what I would ask for. No flexibility that lets the lot code stop at the distribution center door. Any flexibility FDA does adopt should first be tested in a real or simulated traceback, the same pilot-project standard the industry demanded of the rule itself. And FDA should repeat in public what it told Congress and the courts: that the full public health benefit of the rule depends on every covered entity complying.

And to Congress: rescind Section 780, keep it out of the fiscal 2027 bill, and let the Senate’s own language, full compliance and enforcement by July 20, 2028, and not a day later, survive conference this time.

Congress ordered this rule in January 2011 and set a deadline of January 2013. If nothing else slips, enforcement begins in July 2028. That is fifteen and a half years from deadline to enforcement. The records the rule requires already exist, in some form, in warehouses and distribution centers across the country. The only question left on November 6 is whether they will follow the food all the way to the people who eat it.

Where the recalled oysters went and where the 27 sick people live. Sources: VDH recall alert (Oct. 9), FDA safety alert and CDC notice (Oct. 19, 2026). Virginia’s 53 in 18 states is not broken out by state and cannot be mapped.

As of October 20, 2026, the Virginia Department of Health counts 53 people in 18 states sick with Salmonellaafter eating raw oysters, with illnesses beginning in late May and running to September 21. CDC’s October 19 notice and FDA’s safety alert, posted the same day, count 27 in 12 states, with five of 21 hospitalized and no deaths, tied to oysters Little Wicomico Oyster Company harvested from the Little Wicomico River. Virginia says the 27 are a genomic subgroup of the 53. Georgia’s Department of Agriculture says Publix sold the recalled oysters as “James River Oysters” through October 14, five days after the recall, and two of CDC’s 27 live in Colorado, where Marler Clark represents a resident who became ill after eating raw oysters.

Twenty-six sick more people are in Virginia’s count and missing from CDC’s and FDA’s.

Virginia’s outbreak page, updated today, says that as of October 14 there were 53 cases in 18 states with onsets from late May through September 21, and that CDC’s 27 cases in 12 states are “a genomic subgroup” within that total. The arithmetic is 53 minus 27: twenty-six people with Salmonella Telelkebir in the same window whose isolates fall outside the subgroup, in six states no federal page names. CDC’s notice and FDA’s safety alert, both posted October 19, five days after Virginia’s count date, carry only the 27 and do not mention the 53. Within the 27, ten reported eating raw oysters; tag and traceback records exist for seven; two of the seven ate oysters from a single Virginia source and five from several; and the company’s Little Wicomico River oysters were “the only oysters in common to the seven ill people included in traceback.” Nothing on any page says whether the other 26 ate oysters or what the sequencing showed. A genomic subgroup is a decision about how tightly to draw the circle. The people outside it are just as sick, and if they ate oysters, the water that made them sick is not in the recall.

The recalled oysters went to sixteen jurisdictions, and the cases from that harvest have not been counted yet.

The gap between the map’s blue states and its red ones is a calendar, not a contradiction. The recall covers oysters harvested September 18 through October 8. CDC’s last illness onset is September 14, four days before the first recalled harvest day. Every one of the 27 counted so far ate oysters harvested before the recall window, which is why I said yesterday that the recall could not help any of them. Anyone sickened by the recalled harvest would have fallen ill from late September on, and CDC says it takes three to four weeks for a stool culture to become a sequenced isolate that is matched to the outbreak and counted. Those people are in the pipeline now. Seven jurisdictions on the receiving list — California, the District of Columbia, Georgia, Missouri, North Carolina, Nevada and Texas — have no case yet because the oysters that went there are the ones whose illnesses are still being confirmed, and because the summer customers who ate the earlier harvest may not be the fall customers who got the recalled one. Expect the blue states to turn red.

The same lag explains part of the 53-versus-27 gap, and the serotype explains the rest. Virginia’s 53 is every Salmonella Telelkebir illness in the window reported to it as the harvest state through the shellfish-sanitation channel, as of October 14. CDC’s 27 is the set whose isolates sequence closely enough together to be called one strain, pulled at an earlier data cutoff and posted October 19. Telelkebir was the serotype in last year’s oyster outbreak too, 80 sick in 23 states with no harvest area ever found, so some of the 26 outside the subgroup may carry a related strain from other water, and five of the seven traced patients ate oysters from more than one source. None of that is in dispute. What is missing is the sentence that says so: that 53 are sick, 27 sequence together, the rest are under review, and more are coming. Virginia wrote half of it. The federal pages wrote none.

The Publix label said James River, not Little Wicomico.

Yesterday I wrote that the consignee list has not been published; every federal page still says only, “restaurants and retailers.” Georgia’s Department of Agriculture recall page, posted October 15, adds a block headed “Information regarding oysters sold at Publix affected by this recall”: product description “James River Oysters,” GTIN 29953900000, purchase window “9/27/2026 thru 10/14/2026,” discard and do not eat, with a link to Publix’s corporate recall notice. Georgia does not say which stores.

The purchase window runs five days past the recall date.

Virginia’s October 9 recall alert asked receiving states to verify that companies “have stopped selling, serving, and distributing the affected oysters.” Publix’s purchase window closes October 14. Neither Georgia’s page nor the Publix notice says when the dealer’s notice reached Publix or whether oysters stayed on sale after it arrived. A shopper who read Virginia’s alert, FDA’s or CDC’s would have found “Little Wicomico” in all three and “James River” in none; the harvest tag stays with the container, and the label goes home.

Colorado has two of the 27, and the oysters were shipped there.

CDC’s map puts two of the 27 in Colorado, and Colorado is on both receiving lists, so no one must reach for travel to explain them. Marler Clark represents a Colorado resident who became ill after eating raw oysters, and our epidemiologists have requested the state and local health department records. Indiana, Iowa and Kentucky, with one or two cases each, are on neither list; travel or the further distribution FDA mentions could explain that, and the agencies have not said which.

StateSickStateSick
Pennsylvania8Connecticut1
New York4Florida1
Virginia3Illinois1
Colorado2Iowa1
Indiana2Kentucky1
Maryland2New Jersey1

Source: CDC, Where People Got Sick, Salmonella outbreak linked to raw oysters, posted Oct. 19, 2026. Check: 8 + 4 + 3 + 2 + 2 + 2 = 21, plus six states with one case each = 27, matching CDC’s subgroup total; Virginia’s 53 in 18 states as of Oct. 14 is not broken out by state.

Virginia pulled 400 oysters from the river on October 13, and the results were due today.

Virginia collected 400 of the company’s oysters from cages in the river on October 13 for Salmonella testing, with results expected October 20; as I write, the page does not report them. Reopening requires three negative rounds, the second about October 21 and the third the week after, and the closure is expected to run 30 days. Pennsylvania’s positive distributor sample is still awaiting sequencing. Publish the 400-oyster result, the sequencing result and the sanitary survey of the river before anyone harvests there again.

The first retailer’s name came from a state agriculture page, ten days before the federal notices.

The first public word was Virginia’s October 9 alert, written for regulators. The first retailer’s name came six days later from a receiving state. The federal notices came four days after that, carrying half of Virginia’s count. Both of my pending citizen petitions ask FDA to publish the consignee list in every recall, so the next shopper does not have to depend on which state she lives in.

If you bought James River Oysters at Publix between September 27 and October 14, do not eat them.

Throw them out or return them. If you ate raw oysters since mid-September and have diarrhea, fever or stomach cramps, see a doctor, say that you ate oysters and ask for a stool culture; the culture is what lets a state laboratory sequence the isolate and count you. Restaurants and retailers should check shellstock tags for VA-1421-SP and harvest dates from September 18 through October 8.

How many people are sick from the Little Wicomico River oysters?

Virginia counts 53 in 18 states as of October 14; CDC’s October 19 notice counts 27 in 12 states, the genomic subgroup tied by traceback to the Little Wicomico River, with five of 21 hospitalized and no deaths. Both counts are expected to grow, since it takes three to four weeks to link a new case.

Were the recalled oysters sold at Publix?

Yes. Georgia’s Department of Agriculture posted on October 15 that Publix sold them as “James River Oysters,” GTIN 29953900000, purchased September 27 through October 14, 2026, and Publix has its own notice under that title.

Which oysters are recalled?

Whole shellstock oysters harvested by Little Wicomico Oyster Company (VA-1421-SP) from the Little Wicomico River and Little Wicomico River Lower between September 18 and October 8, 2026. Other Virginia growing areas are not included.

CDC announced today that a multistate outbreak of Salmonella Telelkebir infections has been traced to raw oysters harvested by the Little Wicomico Oyster Company of Heathsville, Virginia, from the Little Wicomico River, a small tributary of the Potomac on Virginia’s Northern Neck. As of October 19, 27 people in 12 statesare confirmed sick, five of the 21 with information available (24%) have been hospitalized, and no one has died. Illnesses began between May 29 and September 14, 2026. The company has recalled oysters harvested from September 18 through October 8, Virginia closed the river to shellfish harvesting on October 9, and the advice from CDC, FDA and Virginia is the same: do not eat, sell or serve recalled oysters from Little Wicomico Oyster Company (dealer certification VA-1421-SP).

What the agencies know, and how they know it

Of the 27 sick people, 13 have been interviewed, and 10 of them (77%) reported eating raw oysters, against a 1.6% background rate in CDC’s FoodNet Population Survey. Traceback was possible for seven of the ten; their oysters came from several harvest areas, and Little Wicomico River oysters from Little Wicomico Oyster Company were the only ones all seven had in common. Pennsylvania officials also sampled oysters at a distributor that supplied the restaurants where sick people ate; one sample harvested by the company from the Little Wicomico River was positive for Salmonella. Whole genome sequencing to determine whether it matches the outbreak strain is pending.

Where the sick people live: Pennsylvania 8, New York 4, Virginia 3, Colorado 2, Indiana 2, Maryland 2, and one each in Connecticut, Florida, Illinois, Iowa, Kentucky and New Jersey. When they got sick, by month of onset: one in May, one in June, 13 in July, eight in August and four in September, the last on September 14. Patients range in age from 1 to 86, with a median age of 41.

The recall and the closure

The Virginia Department of Health’s Division of Shellfish Safety and Waterborne Hazards issued a recall alerton October 9 for shellstock oysters harvested from the Little Wicomico River and Little Wicomico River Lower from September 18 through October 8. The recall was triggered by an outbreak declared by the Pennsylvania Department of Agriculture after patients were epidemiologically linked to the company’s oysters. Virginia lists distribution to Colorado, Connecticut, the District of Columbia, Florida, Georgia, Illinois, Maryland, Missouri, North Carolina, New Jersey, Nevada, New York, Pennsylvania, Texas and Virginia; FDA adds California and notes the oysters may have been further distributed. The same day, Virginia issued Emergency Condemnation 010A, closing the downstream portion of the river to all shellfish harvesting through November 7, which Food Safety News noted was eight days into Virginia’s fall oyster season. Oysters from other Virginia growing areas are not part of the recall.

What the dates tell us

First, every one of the 27 reported illnesses began before the recall window opened. The last reported onset is September 14; the first recalled harvest date is September 18. Salmonella symptoms begin six hours to six days after exposure, so none of the 27 could have eaten a recalled oyster. The oysters that made them sick were harvested in summer, sold and eaten months before anyone connected the cases to a river. The recall protects whoever would have eaten the next bag; it cannot do anything for the 27. Later illnesses may still surface, since linking a new case to an outbreak takes three to four weeks, and if any fall inside the window the recall will have earned its keep. None of this is a criticism of Virginia or of the company, which acted within a day of the Pennsylvania finding. It is a description of the system we have: the outbreak is over, or nearly so, before the recall exists.

Second, three of the twelve states with sick people, Indiana, Iowa and Kentucky, are not on the distribution list for the recalled oysters. Those patients may have traveled, the company’s summer customers may differ from its fall customers, or the oysters were further distributed, which FDA says may have happened. CDC and FDA have not said which. The consignee list, the distributors, restaurants and retailers that received these oysters, is what I have been pressing FDA to require in every recall. It has not been published here.

Third, the first public word of this outbreak was not a consumer notice. It was Virginia’s October 9 recall alert, written for receiving states and shellfish regulators. Food Safety News reported it on October 12. CDC’s and FDA’s consumer notices arrived today, October 19, almost five months after the first person got sick on May 29.

The second Telelkebir oyster outbreak in a year

Last December I wrote about a Salmonella Telelkebir outbreak linked to raw oysters that CDC closed on February 24, 2026: 80 sick in 23 states, 34 of 68 hospitalized (50%), with illnesses from June 21 to December 22, 2025. Traceback was done for 19 patients, no single common source was found and nothing was recalled. The map of that outbreak also had Pennsylvania (10), New York (7), Virginia (6) and New Jersey (6) at the top. CDC’s notice today does not say whether this year’s strain is related to last year’s. If the same uncommon serotype is back for a second summer in the same part of the country, the first question is where it lives between seasons.

Salmonella in an oyster is not Vibrio in an oyster

Vibrio is a natural resident of warm coastal water. Salmonella is not. It lives in the intestines of people, livestock, birds and wildlife, and it reaches an oyster bed in sewage, septic drainage, farm runoff and droppings. Under the National Shellfish Sanitation Program, growing waters are classified by sanitary survey and fecal coliform standards. A 2005 study in Applied and Environmental Microbiology tested 1,296 market oysters from 36 bays on all three U.S. coasts, all harvested from approved waters, and found Salmonella in 7.4% of them, concentrated in particular bays and far more common in summer than in winter. It found no relationship between fecal coliform levels and the presence of Salmonella, and it concluded that oyster meat should be tested for Salmonella regularly, in every bay open for harvest, rather than relying on coliforms. Twenty-one years later, growing areas are still classified by the indicator, not by testing for the pathogen. Virginia said when it closed the river that it was testing shellfish from the implicated area. Those results, the sanitary survey of the Little Wicomico and the pollution source it points to should be published before the river reopens on November 7, along with FDA’s sequencing result on the Pennsylvania sample.

If you ate raw oysters

If you have eaten raw oysters since mid-September and have diarrhea, fever and stomach cramps, see a doctor and ask for a stool culture; a culture is what connects a patient to an outbreak. Restaurants and retailers should check with their distributors for Little Wicomico Oyster Company (VA-1421-SP) oysters harvested September 18 through October 8 and dispose of them.

Salmonella

Salmonella sickens more than a million Americans every year and is the leading cause of hospitalizations and deaths among foodborne bacteria. Its reach is remarkable—it turns up in produce, poultry, pantry staples, and pet food alike. Marler Clark, The Food Safety Law Firm, is the nation’s leading firm representing victims of Salmonella outbreaks. Our Salmonella lawyers have represented thousands of victims in the only U.S. law practice devoted exclusively to foodborne illness, which has recovered more than $850 million for victims and families nationwide. We have tied Salmonella outbreaks to cantaloupe, tomatoes, ground turkey, salami, sprouts, cereal, peanut butter, and restaurant meals, and we have brought cases against Cargill, ConAgra, Peanut Corporation of America, Sheetz, Taco Bell, Subway, and Wal-Mart. The Peanut Corporation of America outbreak ended in federal criminal convictions, with the company’s owner sentenced to twenty-eight years in prison. We are also pressing the federal government to treat Salmonella as an adulterant on raw chicken, so that contaminated poultry can be kept off store shelves the way dangerous E. coli already is.

If you or a family member became ill with a Salmonella infection—including lasting complications such as reactive arthritis or irritable bowel syndrome (IBS)—after eating contaminated food, contact the Marler Clark Salmonella attorneys for a free case evaluation.

FAQ

What is Salmonella?

Salmonella is a group of bacteria behind one of the most common—and most deadly—foodborne infections in the United States, sickening more than a million people a year. Symptoms usually begin between 6 hours and 6 days after eating contaminated food and include diarrhea, fever, and stomach cramps that last four to seven days.

What foods cause Salmonella outbreaks?

Poultry, eggs, ground beef, produce, peanut butter, flour, and even pet food have all caused outbreaks. Salmonella can survive for months in dry, low-moisture foods.

Can a Salmonella infection cause long-term problems?

Yes. Some victims develop reactive arthritis—joint pain and swelling that can persist for months—or irritable bowel syndrome after the initial illness resolves.

Who is most at risk?

Young children, adults over 65, and people with weakened immune systems are the most likely to be hospitalized or to suffer severe, invasive infection.

Can I sue for a Salmonella infection?

If your illness is linked to a contaminated product or a recognized outbreak, you may have a claim against those in the chain of distribution. A stool culture matching the outbreak strain is powerful evidence.

Additional Resources:

First, a shout-out to Jerry Hagstrom, who has been covering farm and food policy in Washington longer than just about anyone, for his piece in The Fence Post on the International Fresh Produce Association’s push to get members to sign up for its Advocacy Action Network. Jerry reads the fine print so the rest of us don’t have to.

According to Jerry, IFPA’s new chair, Elyse Lipman of Lipman Family Farms, told members in Orlando that surveys show 88% of consumers lost confidence in fruits and vegetables after this year’s Cyclospora outbreak. Her pitch: join the network so the industry can be mobilized quickly to contact Washington on everything from the farm bill to tariffs to programs that increase consumption. “We need to advocate for fresh with one voice,” she said.

I agree. I have spent more than three decades cleaning up after foodborne illness outbreaks, and I want Americans eating more fruits and vegetables, not fewer. My firm represents many of the people sickened in this year’s Cyclospora outbreak, and I can tell you none of them want to be afraid of a salad.

But one line in the story stopped me. The framing was that the industry’s Cyclospora problem was more with consumers and social media than with government. With respect, the problem was with a parasite that made people sick. Consumers did not lose confidence because of TikTok. They lost it because they, or someone they knew, got sick, and because they were too often left guessing which product, which company and which store. IFPA hired a global crisis communications firm and stood up a Cyclospora Rapid Response Task Force. Fine. But you cannot message your way out of a food safety problem.

So, if IFPA is building one voice, here is what I would like to hear it say:

Bring back the Microbiological Data Program. This one should be first on the list, and IFPA is uniquely positioned to make it happen, because IFPA’s predecessors helped kill it.

A little history. In 2001, USDA’s Agricultural Marketing Service launched the Microbiological Data Program (MDP) to collect data on harmful bacteria in fresh produce. State agriculture labs tested fruits and vegetables pulled from more than 600 distribution sites for Salmonella, Listeria, Shigella and pathogenic E. coli. Sampling ran through 11 states representing roughly half the U.S. population, and MDP supplied close to 90 percent of all available bacterial pathogen data on produce and fed CDC’s PulseNet. It cost about $5 million a year.

It worked. MDP testing prompted at least 19 produce recalls in two years, and it helped pinpoint outbreak sources, including Salmonella Javiana in green onions in 2009. That was the problem, at least for some in the industry. United Fresh and other trade groups lobbied for years to eliminate the program, arguing it cost growers millions in recalls and unfairly targeted farmers. The FY2013 budget zeroed it out, and MDP shut down in December 2012, which, by Food Safety News’ analysis, eliminated more than 80 percent of public pathogen testing of produce. FDA never filled the gap. I called for MDP’s return in 2024, and I am calling for it again.

United Fresh and PMA are now IFPA. If the industry wants to tell consumers it is serious about safety, there is no more credible message than asking Congress to restore and fully fund the surveillance program it once lobbied to end, and to expand it to cover parasites like Cyclospora, which MDP never tested for. Independent, random testing is how you find problems before people get sick and how you show the public the produce aisle has nothing to hide.

Traceability, on time. IFPA says it is pushing for implementation of traceability requirements. Good. Say it loudly, and mean the FSMA 204 Food Traceability Rule, with no more delays. The faster an outbreak is traced, the shorter the hit to the entire category.

Transparency, not secrecy. Nothing kills consumer confidence like a public health notice about an “unnamed” product. I am finalizing citizen petitions asking FDA to stop treating the identity of outbreak-implicated firms as confidential and to require retail consignee lists in Class I recalls. If consumers know exactly what to avoid, they don’t have to avoid everything. I would welcome IFPA’s comments and support.

Fund the people who solve outbreaks. CDC, FDA and state and local public health labs are the industry’s best friends when something goes wrong. Cutting them is a false economy that the produce aisle pays for.

Prevention on the farm. Clean water, clean hands, and audits that actually mean something. The cheapest outbreak is the one that never happens.

The fastest way to win back that 88% is to make sure there is not a next time, and when there is, to tell people quickly and specifically what to throw out. If the Advocacy Action Network wants to carry that message to Washington, sign me up. My number has not changed.

Most of the email that lands in my inbox about E. coli O157:H7 is not funny. It is a mother describing her child on dialysis. It is a health department records request coming back half redacted. It is a defense lawyer explaining that the hamburger was cooked just fine.

This morning was different.

The email came from Ashleigh Diehl, Director of Marketing at GIANTmicrobes in Stamford, Connecticut. It opened with “Hi William” – a name used mostly by my mother and opposing counsel – and said she had just read my recent post, FDA Has Seventeen Open Outbreak Investigations, 14,197 Sick and Two Dead. Ten Name No Food. To her credit, she got the point. Seventeen open FDA files, ten with no food named, an egg investigation FDA calls complete on its own advisory while its table still lists it as active, and USDA’s first active investigation of 2026 being the joint E. coli file. She called it “a snapshot of how murky the attribution still is.” That is about right.

Then came the pitch. GIANTmicrobes makes an E. coli plush, and she thought it might be a fun, visual add to a future story – “or just make you laugh.”

It did.

So, who are these folks?

GIANTmicrobes makes stuffed toys of microbes – and these days cells, organs and other health-related things. The company was founded in 2002 by Drew Oliver, who, according to a 2020 profile by the National Medical Library of the Czech Republic’s museum, began designing plush germs in 2001 while he was a student at the University of Chicago Law School. So a law student who went into microbes. I went the other direction.

Oliver told Nature Microbiology in 2016 that part of the idea came from Richard Feynman’s description of watching a microscopic organism struggle to survive in an evaporating drop of water, and part from a P.J. O’Rourke piece lamenting that he had no way to explain to his daughter what was going on during a stomach ache. Scholastic tells it more simply: he made a stuffed common cold to teach his kids why to wash their hands.

Andrew Klein has been the company’s president since 2015. He has talked to Infection Control Today about infection preventionists using the plush to educate staff and patients, and in her email Ms. Diehl offered him up to talk about why humor helps health education and how plushies can help with vaccination rates.

Per the company, it has sold more than 15 million of these in over 30 countries, in museums, hospitals, bookshops, toy stores, Amazon and Target, and has shown up on NPR’s Wait Wait…Don’t Tell Me, CNN and Fox News, and in The Atlantic and Wired. They also launched a plush SARS-CoV-2 on March 19, 2020, which not everyone found charming.

And E. coli is hardly lonely. The company says it offers more than 150 different microbes and cells, in sizes from three-inch keychains to two-foot “Gigantics.” For those of us in the foodborne illness business, the lineup reads like my case list: there is a Salmonella (“Which came first: the chicken or the egg or the Salmonella?”), a Listeria, a Norovirus pitched as a cruise-ship stowaway, and a C. diff. They even sell a Germs Deluxe 10-packthat bundles E. coli, Salmonella, Listeria and Norovirus with Ebola, measles, flu, the common cold and a sore throat. Beyond the germs there are cells, organs, MRSA and, per their own blog, a leprosy plush that once won something called March Microbe Madness.

Why I don’t mind a cuddly E. coli

I have spent more than thirty years trying to get people to understand something they cannot see. The kids I have represented with hemolytic uremic syndrome did not get sick from a cartoon with big eyes. E. coliO157:H7 does not smile; it produces Shiga toxin and goes after the kidneys.

But if a plush bacterium gets a seven-year-old to wash her hands, or gets a parent to ask why ground beef needs to hit 160°F, or why raw milk and sprouts are a bad bet, I am for it. Fear does not teach people much. Understanding does. And you cannot understand something you can’t picture.

My only suggestion for the product line: a plush for the food that FDA has not named. Ten of the seventeen open investigations would need one. And since Cyclospora accounts for 13,195 of the 14,197 sick on FDA’s table, if they ever make a Cyclospora, I will take that too.

Ashleigh, send the E. coli. It can sit on my desk next to the outbreak tables. It will be the only thing on that desk that makes me laugh.

A tip of the pen to Dr. Kalmia Kniel of the University of Delaware, whose editorial in ASM Food Microbiology, “The 2026 Cyclospora outbreaks: a wake-up call for food safety, surveillance, and prevention,” was published October 12. It is a scientist’s account of this summer: the strange biology of the parasite, why fresh produce stays vulnerable, and why finding the source takes so long. It is open access, and it should be required reading for every regulator, grower, processor and buyer of leafy greens before the 2027 season.

Dr. Kniel ends with five questions. How did a human parasite reach a lettuce field? What safeguards failed? How do we get better traceback? How do we strengthen surveillance? How can industry stop contamination before it happens? I have been trying to answer those questions since July. Here is where I have landed, question by question. But first, the numbers, because they are what make the questions urgent.

The numbers

Dr. Kniel wrote with the late-August figures. The count kept climbing. When CDC stopped updating its case data page weekly on September 15, it had recorded 19,883 laboratory-confirmed, domestically acquired cases with onset between May 1 and August 31, 1,064 hospitalizations and two deaths, in 49 states and the District of Columbia. In the same stretch of 2025, there were 1,180. That is nearly seventeen times as many.

That is only the confirmed domestic count. CDC listed another 9,765 laboratory-confirmed cases still waiting to be sorted into domestic or travel-related, and at least 6,594 more that were not lab-confirmed or were pending interview. Put those together and CDC knew of more than 36,000 cases in some form, on top of 2,078 people who picked up the parasite abroad.

The multistate outbreak tied to iceberg lettuce from Taylor Farms de Mexico closed at 12,883 illnesses, 570 hospitalizations and two deaths across twenty-one states. Subtract that from the season and roughly 7,000 confirmed domestic cases have no food named beside them. Dr. Kniel is right that this was almost certainly several outbreaks at once, and the clusters that remain on FDA’s table deserve answers too.

And all that undercounts. CDC has a number for how much. In 2011, Elaine Scallan and colleagues published “Foodborne Illness Acquired in the United States—Major Pathogens” in CDC’s own journal, Emerging Infectious Diseases (vol. 17, no. 1, pp. 7–15). It is the study behind the federal estimates of how many Americans get foodborne illness each year. For each pathogen, the authors calculated how many illnesses never get counted because people do not see a doctor, are not asked for a stool sample, or are not tested for the right bug. For Cyclospora cayetanensis, the underdiagnosis multiplier is 83.1, with an underreporting multiplier of 1.0. In plain terms: for every laboratory-confirmed case, about 83 people are sick.

Here is the math. All 19,883 confirmed domestic cases this season, times 83.1, is about 1.65 million infections. The 12,883 tied to the Taylor Farms de Mexico lettuce, times 83.1, is about 1.07 million. The roughly 7,000 confirmed cases with no food named, times 83.1, is about 582,000.

For perspective, Scallan’s team started from 239 laboratory-confirmed cases a year and estimated about 19,808 total Cyclospora illnesses annually in the United States. This summer the confirmed count alone, 19,883, passed that estimate of everyone who gets sick in a typical year.

Treat the multiplied figures as orders of magnitude, not counts. The multiplier was built before multiplex stool panels made Cyclospora testing more common, and testing this summer was unusually aggressive, so 83.1 probably runs high today. Cut it in half and the season is still about 826,000 infections. Cut it to a quarter and it is about 413,000. However, you slice it, hundreds of thousands of Americans were sickened, and almost none of them will appear in any government table.

1. How did a human parasite reach a lettuce field?

Dr. Kniel explains the biology better than I can. Cyclospora lives only in people. Infected people shed oocysts that are not yet infectious; they have to mature in the environment first. That is why person-to-person spread is so unlikely, and why investigators look at agricultural water, worker sanitation, septic leaks, sewage and irrigation systems.

When FDA closed its investigation on October 2, it said where it found the parasite: in a tank of wastewater leaving the Taylor Farms de Mexico plant that shredded the lettuce, and in a drainage ditch at a grower that supplied it. That is the same plant at Doctor Mora, Guanajuato, tied to the 2013 salad mix outbreak, when Taylor Farms said it was testing the water. (A disclosure: my firm represents people sickened this summer and has filed cases naming Taylor Farms entities.)

My answer: treat human waste as the hazard it is. Verify toilets, handwashing and worker health on every leafy greens farm supplying U.S. buyers, using auditors who are not paid to pass. Keep processor wastewater away from any water that touches a crop, test it for parasites, and publish the results. And bring back enforceable numeric standards for pre-harvest water on leafy greens, with parasite testing in the growing regions where outbreaks keep happening.

2. What safeguards failed?

The rules are on the books. The Produce Safety Rule covers agricultural water, worker hygiene and sanitation. The preventive controls rule requires supplier programs. The Foreign Supplier Verification Program is supposed to make imported produce meet U.S. standards. In September FDA sent a letter to industryreminding everyone of all three.

What failed is enforcement and the absence of a backstop. Section 780 of the November 2025 appropriations law restricts FDA’s money to enforce the Produce Safety Rule and its pre-harvest water requirements, and bars spending to enforce the traceability rule before July 2028. And there is no validated kill step for Cyclospora on ready-to-eat produce. Dr. Kniel says the same thing in plainer terms: rinsing cannot reliably remove the oocysts, and cooking is what works. Nobody cooks the lettuce on a taco.

My answer: lift the spending restrictions. Hold imported greens to exactly the same standard as greens grown in California and Arizona, backed by on-site FDA inspections. And because there is no kill step, limit how much product from different fields is commingled on one line, keep lots small, and hold and test finished product by lot using FDA’s validated method before it ships.

3. How do we get better traceback?

Dr. Kniel predicts greater investment in digital traceability. I hope she is right, because Congress has gone the other way. FDA’s Food Traceability Rule covers leafy greens and was supposed to take effect in January 2026; compliance was pushed to July 2028. FSMA ordered FDA in 2011 to build a system to receive traceability data, and a Congressional Research Service report says it still does not exist.

My answer: rescind the delay, as the Safe Food Coalition has asked, and in the meantime every company handling leafy greens should comply now. Agree on a standing protocol among growers, processors, chains and grocers to hand sourcing and shipping data to FDA and CDC within hours. And tell the public what investigators know: my FDA citizen petitions ask the agency to stop treating the names of outbreak-implicated firms as confidential and to publish retail consignee lists in Class I recalls, as USDA has done for meat and poultry since 2008.

4. How do we strengthen surveillance?

Dr. Kniel credits the surveillance system with spotting the rise, and it deserves credit. But we entered the worst Cyclospora year on record with less of it. On July 1, 2025, CDC made FoodNet reporting optional for Cyclospora and five other pathogens. It still takes about six weeks to know whether a sick person belongs to an outbreak, which is why the recall came after most people had already eaten the lettuce. And USDA’s Microbiological Data Program, which sampled produce in commerce, was killed in 2012 to save about $5 million.

My answer: put Cyclospora back on the mandatory FoodNet list. Fund the state and local labs and the epidemiologists who interview the sick. Make Cyclospora genotyping routine and push it to state labs, since it is the one tool that does not depend on someone remembering a June salad. Set a public target for shrinking the six-week lag. And rebuild MDP, this time with a parasite on the panel.

5. How can industry prevent contamination before it happens?

Dr. Kniel points out that there is still no cell culture or animal model for Cyclospora, and she calls for academic, government and industry scientists to work together on the gaps. Yet Congress did not fund two federal Cyclospora research projects in the FY2026 agriculture bill, and a third is being moved away from the scientists running it, as reported in August.

My answer: restore that research money. Fund and validate a detection method growers can actually run on irrigation water, sediment and soil at commercial speed, because no one can manage a hazard they cannot measure. And fund the search for a treatment step that kills parasites on lettuce without destroying it.

What FDA has promised

On October 2, FDA announced ten activities it plans before the 2027 season, including an Outbreak Investigation Report, more surveillance of commodities historically linked to Cyclospora, grower outreach and an update to its Cyclospora Prevention, Response and Research Action Plan. That is welcome. It needs dates, dollars and a commitment to publish what investigators did not find as well as what they did. The Action Plan existed before this summer, and so did the outbreak.

I laid out a longer list in September, ten things FDA should do before next May, and last week a list focused on leafy greens. None of it requires new science to start. It requires money and will.

Congress wrote. Nobody answered.

Dr. Kniel’s editorial stands out partly because so many have moved on. Members of the House and Senate sent at least fifteen letters about this outbreak to HHS, FDA, CDC, USDA and Taylor Farms, asking about the source, the staffing, the surveillance cuts and the research money. The deadlines came and went. What answers there were showed up in press statements and on a company FAQ page, not in any published reply. There has been no hearing. Fiscal 2027 began October 1, and Congress can restore the Cyclospora research and lift the traceability delay in the final funding bill without writing another letter. The people who got sick deserve a hearing on the record before the next crop comes up.

The next one

Dr. Kniel writes that “prevention, rather than reaction, remains the cornerstone of food safety,” and that the goal is not to solve the last outbreak but to prevent the next one. I could not agree more. The next growing season in central Mexico is already under way. Nearly 20,000 confirmed illnesses, more than a thousand hospitalizations and two deaths are the price of reacting. Her five questions are the right ones. The people who can answer them have about six months.

As of October 18, 2026, the FDA’s table of active outbreak investigations still lists 50 people sick with E. coli O157:H7 in the outbreak tied to ready-to-eat, multi-ingredient chicken wraps, FDA reference #1421 and FSIS 2026-04. The row has not changed since October 15. The product column still reads “Multi-ingredient wrap with chicken (suspect).” There is still no recall, no brand, no manufacturer, no list of states and no hospitalization or HUS count. And FSIS, the agency with jurisdiction over a product made with chicken, still has no outbreak page of its own, only a link back to the FDA’s table.

The supply chain, however, is talking. It just isn’t talking to the public. My client in Pembroke, North Carolina, one of the two women in the first lawsuit filed in this outbreak, was contacted by the quality systems coordinator of a New Jersey fresh-food manufacturer whose product line includes prepared wraps and sandwiches. She bought Tarragon Chicken Salad Wraps at a Trader Joe’s in Myrtle Beach, was hospitalized with E. coli O157:H7, and was classified by her state health department as a confirmed case in this multistate outbreak. A manufacturer’s quality department does not go looking for someone like her without a reason.

The government knows where these wraps were made

The FDA’s table shows that traceback, on-site inspection and sampling have all been initiated. Chicken wraps made under federal inspection carry an establishment number inside the USDA mark of inspection. A traceback from a sick person’s wrap ends at that number, and an on-site inspection happens at a specific plant. The agencies are not withholding the manufacturer’s name because they don’t know it. They are withholding it because, in their view, the wraps were pulled from the market before the outbreak link was confirmed and are past their shelf life, so there is nothing for consumers to do.

The name is getting out anyway, just not from the agencies

The first brand on the record, Trader Joe’s, came from a federal complaint and from the plaintiffs’ own health department records, not from the FDA or FSIS. Since we filed on October 15, the name has spread through Patch, WPDE, Hoodline and Yahoo. Patch noted that the FDA’s public listing does not identify Trader Joe’s or any brand, and Hoodline reported that Trader Joe’s did not immediately respond to the suit. Now a manufacturer’s quality staff is reaching out to the people who got sick.

That is backwards. Lawyers, reporters and a company’s own quality department are filling a gap the public health agencies chose to leave open. The information is arriving piecemeal and unverified, and without the facts only the agencies can supply: production dates, lots, distribution, and whether anything else was made with the same ingredients. As I wrote in Saturday’s Weekend Wrap-Up, the first brand name came from a courthouse. The second may come from a manufacturer reaching out to a patient.

Why the manufacturer matters more than the retailer

Retailers like Trader Joe’s rarely make their own prepared foods. Co-packers do, and a co-packer that makes wraps for one retailer often makes salads, sandwiches and wraps for several others, sometimes on the same lines and with the same ingredients. The agencies say they are looking at possible ingredient-level contamination, and Food Safety News reports that USDA is trying to determine whether the chicken went into other products. If the problem was the chicken, the tarragon chicken salad, or something else handled at that plant, the question is not just which wrap made people sick. It is what else came off that line, under that establishment number, and where it went.

When FSIS announces a recall, it names the establishment, prints the establishment number, and posts a retail distribution list. A product that is “proactively removed” before a link is confirmed gets none of that. The establishment number stays in an agency file, and the public is left to piece it together from lawsuits and news stories.

This is what my petitions are about

My two draft citizen petitions, one on disclosing the firms implicated in outbreak investigations and one on publishing consignee lists that show where product went, are still being edited and remain open for comment. I laid out how this outbreak bears on both in an earlier post. This week’s development makes the point more sharply. The identity of the firm is not a secret inside the industry. Trader Joe’s knows who made its wraps. The manufacturer knows who it sold them to. The agencies know both. The only people who don’t know are the 50 confirmed patients, the many more who were never tested, and the doctors treating them.

What should happen now

FSIS should name the establishment and its number, say whether any other products were made with the same chicken or the same chicken salad, and publish the states, the hospitalizations and the HUS count. Trader Joe’s should tell its customers who made the Tarragon Chicken Salad Wraps and which stores sold them. And if the New Jersey company that reached out to Ms. Gottlieb made these wraps, it should say so publicly instead of contacting the sick one person at a time.

Marler Clark represents Ms. Gottlieb and Meaghan Egan Bright of Somerville, Massachusetts, and is investigating other illnesses in this outbreak. If you ate a prepared chicken wrap in August or September and developed diarrhea, especially bloody diarrhea, see a doctor, ask for a stool test for Shiga toxin-producing E. coli, and report the illness to your local health department.

A tip of the pen to Gina Shaw, whose piece in the October issue of Infectious Disease Special Edition, “Invaders From Planet Lettuce,” asks the right question: how did produce become the vehicle that makes so many of us sick? It is the clearest explanation I have read of why this summer’s Cyclospora season was the largest ever recorded in the United States, and it is written for the doctors who must diagnose it. It deserves a wider audience, especially among the people who can do something about it.

Shaw lays out the scale. By CDC’s early September update, more than 18,000 laboratory-confirmed cases had been acquired in the U.S. since May 1, with thousands more awaiting confirmation, against 1,180 in all of 2025. Most trace to the outbreak linked to iceberg lettuce from Taylor Farms de Mexico, which FDA closed at 12,883 illnesses, 570 hospitalizations and two deaths. Michigan alone reported more than 14,000 cases, in a state that saw 50 the year before.

Her sources, Dr. David Freedman of the University of Alabama at Birmingham and Dr. Craig Hedberg of the University of Minnesota, explain why this one got so big. Cyclospora used to ride in on raspberries, basil and cilantro, foods most people eat rarely or in small amounts. This time it rode in on lettuce, which about 80 percent of Americans eat in any given week, served through a fast-food chain. As Dr. Freedman put it, “Now the lettuce is bringing it to us.” Industrial processing then does the rest: millions of heads mixed in one plant, so a few bad ones contaminate thousands of bags. And the parasite survives for weeks in soil and water and shrugs off chlorine washes.

Then Shaw describes a system under strain. The outbreak hit a year after CDC made FoodNet surveillance optional for Cyclospora and five other pathogens. Case reports piled up faster than short-staffed health departments could interview patients, which slowed the search for sources. Michigan pulled people from other programs to keep up. And unlike Salmonella or E. coli, there is no real-time genetic fingerprinting for Cyclospora, so investigators could not always tell whether a patient belonged to the big outbreak or one of the smaller clusters. Her table of open FDA investigations as of late September is sobering on its own: sprouts, raw milk cheese, jalapeños, eggs, infant formula and a long run of outbreaks with the food listed as unknown.

Shaw ends with Dr. Freedman’s warning that preventing a repeat in 2027 will take more inspection and mitigation of at-risk produce, and more people to do it, than we have now. I agree. So here is my list, focused on the food that made so many of us sick this summer: leafy greens.

What needs to be done about leafy greens

  1. Unwind the traceability delay. FDA’s Food Traceability Rule covers lettuce, spinach and other leafy greens, and it was supposed to take effect in January 2026. Compliance was pushed to July 2028, and Congress wrote the delay into law. The Safe Food Coalition has asked Congress to rescind it. It should. In the meantime, every grower, processor, distributor and restaurant chain handling leafy greens should comply now. This summer, perfectly good lettuce was plowed under because nobody could say quickly where the bad lettuce went.
  2. Fix the water in the fields and the plants. In 2024 FDA replaced numeric water testing with “systems-based” assessments. For a crop grown close to the ground and eaten raw, that is not enough. We need enforceable numeric standards and routine testing for pre-harvest water on leafy greens; parasite testing in irrigation and wash water in the growing regions where outbreaks have occurred; processor wastewater controls (FDA found Cyclospora in a Taylor Farms de Mexico wastewater tank, and Taylor Farms promised water testing there in 2013); and research money for a wash or treatment step that actually kills parasites on lettuce without destroying it.
  3. Break up the batches and test before it ships. Shaw’s sources explain how a single plant mixing millions of heads lets a few bad ones contaminate thousands of bags. Processors should limit how much product from different fields and growers is commingled on one line or shift, keep lots small enough to trace and recall precisely, and test finished product by lot, holding each lot until results come back negative, using FDA’s validated methods for the pathogens of concern, including Cyclospora. Testing will not catch every contaminated bag, but small, held lots shrink an outbreak when one gets through and give investigators a lot number instead of a guess.
  4. Keep cattle away from lettuce. Setbacks between animal feeding operations and leafy greens fields, and the canals that irrigate them, should be required by rule, not left to buyer guidance. The 2018 Yuma romaine outbreak traced back to irrigation canal water near a large feedlot, and the Salinas Valley outbreaks that followed pointed to cattle on adjacent land. We keep finding the same source and keep acting surprised.
  5. Hold imported greens to the same standard. Lettuce grown in Mexico for U.S. buyers should meet the same water, setback and sanitation requirements as lettuce grown in California and Arizona, enforced through the Foreign Supplier Verification Program and backed by on-site FDA inspections.
  6. Verify sanitation on the farm. Toilets, handwashing, worker health and water at leafy greens farms supplying U.S. buyers should be checked by auditors who are not paid to pass. Training is not verification.
  7. Rebuild the trip wire. USDA’s Microbiological Data Program sampled lettuce, spinach and other produce in commerce for about $5 million a year and triggered dozens of recalls before it was killed in 2012. Bring it back, with leafy greens at the top of the list. It is the cheapest insurance the produce industry will ever be offered.
  8. Count the sick again. In July 2025, CDC made FoodNet reporting optional for Cyclospora and several other pathogens. The largest Cyclospora outbreak in history arrived a year later, on a food 80 percent of us eat every week. When the vehicle is that common, every day of delay means more people sick. Restore full FoodNet surveillance, fund the state and local labs and epidemiologists who interview the sick and find the source, and pay for real-time Cyclospora genotyping so investigators know which cases belong to which outbreak.
  9. Agree on data sharing before the next outbreak. A standing protocol, worked out now among leafy greens growers, processors, fast-food chains and grocers, for handing shipping, sourcing and test data to CDC and FDA within hours, not days.
  10. Publish root cause analyses and solve the unsolved. FDA has promised a report on the lettuce outbreak. Every leafy greens outbreak should get one, published promptly and in full, and the four other Cyclospora outbreaks this year that still list the source as “not yet identified” deserve an explanation of why.
  11. Stop rolling back FSMA. The Produce Safety Rule is the floor for every leafy greens farm in the country. Every “burden” removed in the name of deregulation was a tool someone needed this summer.
  12. Name the firms, publish the consignee lists and let FDA sample where the evidence points. I have drafted three FDA citizen petitions that go straight at how leafy greens outbreaks are handled: one asking FDA to stop treating the identity of outbreak-implicated firms as confidential, so people know which lettuce to throw out; one asking it to publish retail consignee lists in Class I recalls, as USDA has done for meat and poultry since 2008, so people know which stores sold it; and one asking it to use its communicable disease authority to require sampling at animal feeding operations implicated in multistate outbreaks, so investigators can finally test the cattle next to the field.

The cheapest outbreak

Gina Shaw’s headline calls it the rise of foodborne illness. It does not have to keep rising. None of the items on my list requires new science. Most require money, will and the willingness to make the people who grow, process and sell our leafy greens do things differently. Dr. Freedman is right that whether we can get it done before next summer is the big question. The 2027 growing season is about six months away. The cheapest outbreak is the one that never happens.