
Three federal websites are carrying the same outbreak this week, and none of them will tell you what food is in it.
On September 23, FDA’s CORE investigations table added reference #1421: E. coli O157:H7, 25 sick, traceback initiated. The entry carries a second number, USDA-FSIS reference 2026-04, and it is the only active row on FDA’s table with a USDA number attached. FSIS’s outbreak table now lists 2026-04 as a September 2026 investigation, pathogen E. coli O157:H7, product Unknown, Active: Yes, with a note that FDA and FSIS are investigating it together. Before this row, FSIS had listed three investigations for all of 2026, every one of them marked closed. This is the fourth, and the only one open.
CDC’s page does not list an outbreak until it has something to tell people to do. What it posts is a weekly count of active multistate investigations by germ. This week’s count: six for E. coli, five for Listeria, twenty for Salmonella, one for Campylobacter. CDC does not say which six E. coli clusters those are.
Is it the same outbreak?
Yes. The two tables point at each other: FDA’s row carries FSIS’s number and FSIS’s row carries FDA’s. FSIS’s own FAQ says an outbreak may appear on both tables when products regulated by both agencies are suspected sources. FDA’s CORE table is, in practice, a multistate table, and FSIS notes that CDC generally works only multistate investigations, so #1421 is almost certainly one of CDC’s six. Almost certainly is as far as the public record lets anyone go.
Why is CDC involved?
CDC is on every multistate cluster, whatever the food. The cases are matched by whole genome sequencing through PulseNet, the interviews are done by state and local health departments, and CDC coordinates the epidemiology. By its own description, CDC coordinates between 17 and 40 multistate investigations in a typical week, and not all of them produce a public notice. CDC being involved is the default, not the signal.
Why are both FDA and USDA on it?
This is the part worth understanding, because the two agencies do not share jurisdiction over food. They divide it. FSIS covers meat, poultry and processed egg products under the Federal Meat Inspection Act, the Poultry Products Inspection Act and the Egg Products Inspection Act. FDA covers everything else under the Food, Drug, and Cosmetic Act. Where a food contains both, a formula decides: products with more than 3 percent raw meat or poultry, or 2 percent or more cooked, are FSIS’s; anything under those thresholds is FDA’s. The line produces results that have been mocked in Congress for twenty years. Cheese pizza is FDA’s; pepperoni pizza is FSIS’s. A packaged open-face meat sandwich is inspected by FSIS and a closed-face sandwich by FDA, and GAO reported in 2001 that the split exists because FSIS lacked the resources to inspect every sandwich maker, so it kept the less common kind.
An outbreak lands on both tables when the epidemiology has not settled on one side of that line. FSIS says it posts an active investigation only when there is compelling epidemiologic, sampling or traceback evidence that an FSIS-regulated product is a confirmed or suspected source. It also says that calling a product suspected does not mean other foods were ruled out, and that an investigation can end up implicating a product FSIS does not regulate even when meat or poultry was the first suspect. On FDA’s side, a traceback has to start from something, a product or a point of sale, so FDA has a lead it is not naming. Put the two rows together and they read: the sick people ate something with a meat or poultry component and an FDA component, and neither agency has been able to eliminate its half.
There are two ways that happens, and they are different animals.
The first is a single mixed product that sits on one side of the line by formula. A chicken Caesar salad kit or a ready-to-eat pasta meal with chicken is an FSIS product on paper, but the contaminated ingredient inside it can be the lettuce, which pulls FDA into the traceback. The last two rows on FDA’s table to carry a USDA number were Listeria outbreaks in prepared pasta meals and ready-to-eat deli foods, both multi-ingredient products.
The second is a meal rather than a product. The customer ate a hamburger. The patty is FSIS’s; the lettuce and the onions are FDA’s. For E. coli O157:H7 this is the more likely shape, because its two biggest vehicles, ground beef and leafy greens, sit on opposite sides of the jurisdictional line, and a restaurant signal drags in both agencies at once.
What happened the last time it was a hamburger
On October 22, 2024, FDA, FSIS and CDC announced a joint investigation of E. coli O157:H7 illnesses in people who had eaten McDonald’s Quarter Pounders and said investigators were working out whether the slivered onions or the beef patties were the source. FDA traced the onions; FSIS traced the patties. The interviews could not separate the two: of the people who could remember what they ordered, 83 percent reported a menu item with slivered onions and 79 percent reported one with a quarter-pound patty. Three people had onions without the patty. One had the patty without onions. By October 30, FSIS reported that its traceback of the patties had not identified a beef source and that Colorado’s testing of the patties was negative, and Taylor Farms’ yellow onions were the likely vehicle. The final count was 104 sick in 14 states, 34 hospitalized and one dead. My firm represented people sickened in that outbreak.
The McDonald’s file also shows why the split matters to consumers and not only to lawyers. On the day of the announcement, McDonald’s pulled both the slivered onions and the Quarter Pounder patties from the affected states while the traceback ran. Nobody waited for the tie to be broken, and the public was told which two ingredients were in play.
What the public will and will not be told
For #1421 there are three doors. CDC posts a notice when there is something actionable to tell people, and it says plainly that not every investigation gets one. FDA posts an advisory when it names an FDA-regulated food. FSIS issues a public health alert or a recall when the evidence lands on meat or poultry. If none of those opens, the file closes the way #1382 did this month: romaine lettuce named only at closure, no grower, no processor, and nothing said while people were still eating it. FSIS’s own answer, on its outbreak page, to what if I want to know more about a specific investigation, is a link to its FOIA office.
What I would ask for is modest. Say which states. Say the onset dates. If the suspect is a mixed product, say so, and say which ingredient each agency is tracing, the way FDA and FSIS did within hours in 2024. The McDonald’s outbreak reached 104 people. This one is at 25, and 25 is a floor: a cluster that has produced two federal reference numbers and a traceback has not finished growing.
Why I am watching which half of the sandwich it is
I spent the first decade of this work suing over hamburger. That business went away because FSIS declared E. coli O157:H7 an adulterant in raw ground beef in September 1994 and the industry built its testing and its liability around that word. My firm’s hamburger cases ran from Jack in the Box in 1993 to the ConAgra recall in 2002 and are now close to zero. Since about 2000, the E. coli cases have mostly been lettuce. The bacteria did not move. The regulator did, and the half of the food supply that got the adulterant standard is the half that nearly stopped sending me clients. When FDA and FSIS both open a file on an O157 outbreak, the question I care about is not only what the food was. It is which side of the line it was on, and whether the regulator on that side has sampled for the bug the way FSIS has sampled ground beef since the fall of 1994.









