Julia Ingram at CBS News reported yesterday that the Food and Drug Administration carried out just under a thousand foreign food safety inspections in 2025, and that the plant its own traceback later named in this outbreak was not one of them. The last time an FDA investigator walked into Taylor Farms de Mexico at Doctor Mora, Guanajuato, was 2019. The time before that was August 2013, and that visit happened during an outbreak that infected 631 people in twenty-five states with Cyclospora.

I went looking for both records. Only one of them exists as a document, and the reason the other one does not is the more important story. Every source below is linked so anyone can check the work, and where a document is not public, I say so and say what we are doing about it.

The 2013 record is public, and I have written about it more than once. It is FDA’s environmental assessment, conducted that August with COFEPRIS, SENASICA, SAGARPA, CESAVEG, Guanajuato state health authorities and CDC. It is not an inspection report and should not be called one; CBS calls it a review, which is closer. It walks the processing plant and five ranches, catalogs roughly 835 samples, records that the facility washed combined salad components in recycled wash water and concludes without determining how or where contamination occurred. Its second recommendation was that the firm determine whether Cyclospora is a reasonably likely hazard in that growing region and, if it is, re-evaluate the wash step. Same region, same facility, same parasite, same commodity, thirteen years later.

The 2019 record is not a document at all, and nobody is hiding it. The inspection found no violations. No violations means no Form FDA 483 was issued. No 483 means there is nothing for FDA to publish, because the agency posts inspectional observations in its reading room and only when observations were written. What exists instead is a row in a spreadsheet: the firm’s name, its establishment identifier, the date the inspection ended, the project area, a three-letter classification, and a column indicating whether any citations were posted. For this facility that column reads no. That row is the entire public record of the last time the United States government set foot in the plant that FDA’s traceback would name seven years later.

CNN got one step further on August 6. Its reporters established from public records that the 2019 inspection was conducted by Wendy Johnecheck, now an extension professor of food safety at the University of New Hampshire. She declined to discuss Taylor Farms or the inspection. Speaking generally, she described an enormous range of infrastructure and sanitation practice on farms across Mexico, some of it more sophisticated than almost anything in the United States. That, and the fact that she issued no citations, is the sum of what the public knows about the visit.

What I would like to know is what she was sent there to look at, and there is a way to find out. The narrative account of any FDA inspection is the establishment inspection report, and an EIR can be requested under the Freedom of Information Act whether or not observations were issued. This week my firm is filing FOIA requests with FDA’s Division of Freedom of Information for the establishment inspection reports covering all three visits to this facility — the routine inspection in 2011, the outbreak response in August 2013, and the inspection in 2019 — along with the assignment and any sample collection records associated with each. I will publish what comes back. If the answer is that no responsive records exist, or that they are being withheld while an enforcement action is pending, I will publish that too, because that answer is itself worth knowing.

Three weeks ago, I wrote that I had looked for other FDA inspection reports on this facility, could not find any, and assumed they must exist. They do. The public record shows three visits. Two of them produced nothing a member of the public can read: the routine 2011 inspection FDA described at the time as turning up no notable issues, and 2019.

That gap matters because 2019 is the only visit sitting between the 2013 assessment and this outbreak, and 2013 left two obligations behind. One was the recommendation to make a hazard determination and revisit the wash step. The other was the price of reopening: FDA allowed the plant to resume shipping on August 25, 2013, and said its decision rested in part on the environmental assessment and in part on its review of a Cyclospora product sampling plan the company had put in place, alongside its commitment to a broader program covering both its products and its water. I have already written that thirteen years later I cannot find one public result from that program. The 2019 inspection was the single opportunity anyone had to ask whether it ever ran. Whether anyone asked is sitting in an EIR that, as far as I can tell, nobody has requested. Now somebody has.

Now the scale of the thing. The Food Safety Modernization Act set a rising annual target for foreign inspections and capped it at 19,200 beginning in 2016. FDA has never reached even ten percent of that number in the decade since, under administrations of both parties. The agency told the Government Accountability Office as early as 2015 that the figure was unworkable, then ran its own analysis putting the number it actually needed at 4,700 and never carried that number to Congress. GAO pressed the point again this past January. Foreign food inspections fell twenty-nine percent last year, to the lowest count outside the pandemic since 2011. FDA had 432 inspectors in 2024, twenty of them assigned to foreign work, against the 5,000 inspectors FSMA directed the agency to hire, a number FDA says it has never had the budget to reach. At roughly $38,700 per foreign inspection, meeting the statute Congress wrote would cost about $743 million a year, more than a tenth of the entire agency budget. The mandate has been on the books for a decade, and nobody has either funded it or repealed it.

Set those numbers against this company. Taylor Farms’ Mexican subsidiaries are the source of more vegetable and salad shipments into the United States than any other single manufacturer in the world, according to the FDA import data CNN reviewed. In the first six months of this year, five of the company’s more than 168,000 produce shipments from Mexico were physically examined by FDA at the border. Five.

None of this is concealment. It is design. Federal law places the primary burden of verifying a foreign supplier on the American importer, which in practice means paperwork about a supplier rather than anyone walking the field. The day-to-day work of food safety sits with the company. Taylor Farms says it invests $200 million a year in food safety protocols and independent audits. That is a real number, and as Food Safety News pointed out, it is also under three percent of the roughly seven billion dollars in annual revenue Forbes estimates for the company, spread across every plant and every product line it runs. The public has no way to audit any of it, because the audits are private and the one government witness who could have described the plant came and went in 2019 without writing anything down.

Here is the asymmetry I keep running into, and it is not unique to this company. When a plant is clean, or at least when an investigator documents nothing objectionable in the project areas covered on the days he happened to be there, the public gets a row in a table. When people get sick, the public gets a document. Every substantive thing anyone knows about Doctor Mora comes out of the 2013 assessment: the recycled wash water, the positive fecal coliform result off drip irrigation tape that triggered no corrective action because it fell below the firm’s own action level, the recycled wash water sample that came back inconclusive because turbidity defeated the filtration method, the antibiotic prescriptions written for harvest crews during the outbreak window. Every line of that exists because 631 people were already infected. The same is true of the 2024 Colorado Springs report, which exists because an E. coli outbreak tied to onions put people in the hospital.

We have built a system in which the most reliable way to learn something real about a food plant is for that plant to hurt somebody first. That is a strange thing to have built on purpose, and it is worth saying plainly that it was not built by this administration or the last one. It has been the arrangement for as long as I have been doing this.

Three things would help, and none of them require new legislation. FDA should release the establishment inspection reports for all three visits to this facility rather than waiting on the FOIA requests we are filing, because a request that takes eighteen months to answer is not transparency in the middle of an outbreak this size. The congressional letters already on the table demand documents from the company going back to January 1, 2013; the same committees should be demanding FDA’s own file on the plant, which is smaller, faster to produce, and written by people with no stake in the answer. And a classification of no action indicated should not be the end of the public record for a foreign facility shipping at this volume. Publishing the scope of a foreign inspection, what was covered, over how many days, by how many people, would cost the agency almost nothing and would let the rest of us tell the difference between a plant that was examined and found sound and a plant that was merely visited.

I have spent thirty-three years reading documents that exist only because somebody ended up in a hospital bed. The 2013 assessment is one of them. The 2024 Colorado report is another. There is no 2019 document, and that absence is not evidence that nothing was wrong at Doctor Mora in 2019. It is evidence that nothing was written down. In a system this thin, those two things have become the same thing, and the fifty-state countI have been keeping since July is now past twenty-eight thousand people.

Phyllis Entis got there first, the way she always does when the subject is pet food. Her post at eFoodAlert lays out the complaint the Department of Justice filed on August 7 in the Western District of Washington, on behalf of FDA, against Arrow Reliance Inc., doing business as Darwin’s Natural Pet Products, and against Gary T. Tashjian personally — six counts under the Federal Food, Drug, and Cosmetic Act and a demand for a permanent injunction. Phyllis has been documenting this company since 2016, on eFoodAlert and in TOXIC, and she kept the receipts nobody else bothered to keep. Go read her. She has earned every reader she gets. Huge shout out, Phyllis.

I want to talk about paragraph 36.

There, the government tells the Court that in June 2025 it learned of a four-year-old child who had fallen ill the previous August with a Shiga toxin-producing E. coli infection and hemolytic uremic syndrome, that the child was hospitalized with severe illness, and that the child “continues to face chronic kidney disease.” The family fed its dog Darwin’s. Testing of unopened food from the family’s freezer found Salmonella in two lots and E. coli O157:H7 in a third. Paragraph 39 adds the sentence that matters most: FDA compared the genome of the O157:H7 from the child’s stool to the genome of the O157:H7 from the dog food in that house, and the sequences were an exact match.

That child has a name. He is Noah Ruiz, and we represent him and his family. Onset was August 19, 2024. A stool specimen taken at St. George Regional Medical Center on August 22 was PCR positive for E. coliO157:H7; the Utah state public health lab isolated the organism and sequenced it. Noah developed HUS and spent a month at Intermountain Primary Children’s Hospital. He had eaten no ground beef, no leafy greens, no sprouts, no fresh herbs. What he had was a dog named Rodeo, fed Darwin’s raw food exclusively for ten years, who started vomiting the day before Noah got sick.

In May 2025 Noah’s parents sent unopened frozen packages from their own freezer to IEH Laboratories, accredited under FDA’s own LAAF program. Beef Dog Food, Lot 10662: E. coli O157:H7. Chicken, Lot 10683: Salmonella Infantis. Duck, Lot 10638: Salmonella Hadar. Whole genome sequencing on the O157:H7 from the beef matched Noah’s isolate. FDA asked Arrow Reliance to recall those lots. Arrow Reliance said no. FDA issued an advisory on July 29, 2025, telling people to check their freezers, because an advisory is all the agency has left when a company simply refuses.

Read the rest of the complaint and Noah stops looking like bad luck. Of the eighteen most recent samples FDA has collected since 2023, twelve carried pathogens — nine Salmonella, one Listeria monocytogenes, two both. From 2016 through January 2026, FDA logged forty-nine consumer complaints of pets sickened after eating this food: thirty-four dogs, five of them dead, and thirty-five cats, four of them dead, and that is only the fraction of families who knew to call the government. Warning letters went out in April 2018 and February 2023. Recall requests were refused in 2022, in 2023, in 2024 and again in 2025, including a formal Part 7 request in October 2023 that told the company in writing that FDA might take action against it. Nine isolates pulled from Darwin’s food between 2017 and 2025 match human clinical isolates sitting in the national database. And in August 2022, rather than recall two lots of cat food, the company sued FDA to stop the agency from warning the public. It lost that one too.

Count V is the one that should stop you cold. The government alleges that Tashjian has never registered the Tukwila plant as a food facility, and that FDA told him in the February 16, 2023, warning letter that he had to. Eighty-five thousand pounds of raw meat a week leaves that building, ninety-two percent of it across state lines, from a facility that on paper does not exist.

Count VI is the one that tells you what kind of company this is. Because darwinspet.com promises that chronic illness like diabetes, skin allergies and arthritis may fade without medication, that seizures stopped in somebody’s dog, that feeding raw prevents feline UTIs and IBD, the government says the product is an unapproved new animal drug. A firm that would not concede its food might be contaminated was perfectly willing to tell you the same food could cure your dog’s epilepsy.

An injunction is the right remedy here, and it is roughly eight years late. It is also worth being honest about what it is not. It carries no penalty, no restitution, and — even now, today — not one recalled lot. Under the FDCA the government’s relief runs forward, not back. Everything owed to a family whose son left the hospital with kidneys that will never be what they were is left to the civil side, which is to say to families like the Ruizes and to lawyers like me.

It took two warning letters, five refused recall requests, forty-nine sick pets, nine genomic matches to human illness, and one four-year-old on a pediatric renal ward before the United States walked a complaint into a courthouse fifteen miles from the plant. If you feed your animals raw, read the complaint. And read Phyllis.

Yesterday morning I posted a piece counting every criminal food safety prosecution the United States has brought in the last forty years. Eighteen. Hours later I learned that on August 7 the Department of Justice had walked into federal court in Seattle, on behalf of FDA, and sued Arrow Reliance Inc., doing business as Darwin’s Natural Pet Products, along with its president and founder Gary T. Tashjian. Six counts under the Federal Food, Drug, and Cosmetic Act. The relief requested is a permanent injunction. The timing was almost too neat, because the complaint the government filed reads like a criminal referral that nobody bothered to write.

Introducing adulterated food into interstate commerce is a crime under 21 U.S.C. § 333(a)(1), and it requires no proof of intent, no proof of knowledge, not even proof of negligence. Under United States v. Dotterweichand United States v. Park, a corporate officer who stood in a responsible relation to the violation and had the authority to prevent it is criminally liable whether or not he knew it was happening. Paragraph 5 of this complaint reads like a Park charging document drafted in advance: Tashjian has “ultimate responsibility” for the quality system, the “duty, power, and authority to prevent, detect, and correct quality violations,” and control of the company’s website. Nobody had to go looking for that language. The government put it in a civil pleading.

If the allegations are proven, the misdemeanor exposure alone is real. A conviction under § 333(a)(1) carries up to a year in prison per count, and through the Alternative Fines Act up to $100,000 for an individual — $250,000 where death results, or twice the gross gain — with the corporation exposed to $200,000 to $500,000 per count or, again, twice what it made. With 85,000 pounds of raw meat going out that door every week and shipments running to warehouses in Pennsylvania and Texas, “per count” is the number that matters.

And the felony road is open too. Section 333(a)(2) makes it three years per count if a violation is committed with intent to defraud or mislead. Eight years of positive test results, two warning letters, four refused recall requests including a formal one under Part 7, a lawsuit filed against FDA in 2022 to stop the agency from telling the public that its cat food had Salmonella in it, and a website that promises diabetes and arthritis symptoms will fade and that somebody’s dog stopped having seizures — that is a decent place for a grand jury to start looking. Mail and wire fraud sit right behind it at twenty years apiece, and the customers here paid a subscription price for food sold as medicine.

None of this is a novel theory. It is the Quality Egg template, exactly. Austin “Jack” DeCoster and his son Peter each served three months on strict-liability misdemeanors for eggs that made people sick, and their company paid $6.79 million, and the Eighth Circuit affirmed the prison sentences over a constitutional challenge. The facts alleged here are not softer than those. What is different is that no one has asked.

The lawyers who signed this complaint sit in the same corner of the Civil Division that brings the government’s FDCA criminal cases. The file is built. The isolates are sequenced. The genome from the pet food matched the genome from a four-year-old with hemolytic uremic syndrome, and the government said so in writing, in paragraph 39, under its own signature. Eighteen prosecutions in forty years is not a shortage of candidates. It is a choice, made over and over, and here is one more chance to make it differently.

FDA published its final Guide to Minimize Biological Hazards in Ready-to-Eat Fresh-Cut Produce on August 11, a day ahead of its Federal Register date, and I have Marion Nestle to thank for the heads up[1]. Eighty pages, eight years from draft to final, nonbinding, and aimed only at registered processors — not at farms, and by FDA’s own footnote not at restaurants or retail. It reads like housekeeping until page thirty-eight, where the agency writes that it is not currently aware of any antimicrobial that would significantly minimize or prevent Cyclospora cross-contamination and be suitable for use on fresh-cut produce. Elsewhere it adds that a wash water process control is not a kill step at all, and that antimicrobials do not reach pathogens that have attached to the produce or been internalized in the tissue.

There is no way to wash this parasite off a bag of lettuce. I have been saying it since July. The government has now written it down.

Two other things in the document matter as much. FDA states that Cyclospora cayetanensis is a known or reasonably foreseeable biological hazard in berries, fresh basil, fresh cilantro, and fresh salad mixes, including salad mixes that contain lettuce and carrots — which is not an abstraction, it is a product description. And it states that fecally contaminated agricultural water, and fecal deposits from infected field workers on or near harvested product, are currently considered reasonable routes of transfer, citing the 2023 NACMCF report on the parasite in produce — the federal report co-chaired by the man who is now chief science officer of the International Fresh Produce Association. Human waste in the water and human waste in the field, in the agency’s own voice.

What FDA tells processors to do about it is the part with teeth. Validate the wash against a bacterium, it says, and address what the antimicrobial cannot control through supply-chain controls. It then lists Cyclospora alongside pathogenic E. coli, Salmonella and Listeria among the hazards that can cause serious adverse health consequences or death, for which the appropriate supplier verification is an onsite audit by a qualified auditor before first use and at least annually after. In the contract-harvester example it recommends reviewing the harvester’s records of required worker training on the hazard posed by Cyclospora for people who hand harvest ready-to-eat lettuce.

That is a standard of care in four steps, with a date on it. The parasite is foreseeable in salad mix. No wash controls it. Control it in the supply chain. Verify by qualified annual audit. And an obligation follows that nobody is talking about: the preventive controls rule requires a facility to reanalyze its food safety plan whenever it becomes aware of new information about potential hazards in its food. This guidance is that new information. There is no phase-in, because guidance is the agency’s current thinking the day it posts. Which leaves a question worth asking every fresh-cut processor in the country from here forward. What did your reanalysis say about this organism after August 2026, and if you did not run one, why not.

Which brings me to what is missing, and it is the whole ballgame. If the wash cannot control it, and the answer has to come from upstream, what does eighty pages say about testing the water?

The water inside the plant gets one paragraph: make it potable, and a footnote pointing to EPA’s drinking water rules as adequate. Those rules do regulate parasites — a contaminant level goal of zero for Cryptosporidium, 99.9 percent removal for Giardia lamblia. This one is not among them. The wash water gets forty pages of genuinely exacting instruction — sensor placement, organic load by chemical oxygen demand, ten parts per million of free chlorine as the critical limit, pH below 7.5, titration twice a shift, records that must show 22 ppm and not the word OK. Read every one of those measurements and not one of them looks for an organism. All of it measures the chemistry of a treatment the same document says does not work on this parasite. Upstream, water appears exactly once, as a certificate that the harvest water came from a public system. A certificate of source, not a result. Irrigation water is not addressed at all, because irrigation water belongs to the Produce Safety Rule, whose only numeric microbial criterion is generic E. coli, which FDA’s own fact sheet says will not identify this organism.

The loop closes on itself. The antimicrobial cannot control the parasite, so FDA sends it to the supply chain. The supply-chain control is an audit against the produce rule. The produce rule measures a bacterial indicator. Nowhere in that chain is anyone looking for Cyclospora. The agency drew a careful map from the hazard to the control, and the last box on the map is empty.

It did not have to be. FDA has had a validated method for detecting the parasite in fresh produce, romaine included, since 2017, and a validated method for agricultural water since 2020 that found roughly six oocysts in ten litres. Chapters 19b and 19c of its own Bacteriological Analytical Manual. I could not find either one cited anywhere in eighty pages and fifty references.

Credit where it is owed. For bacteria this is a real improvement, and the improvement is the second worked example — peracetic acid on diced onions, dosed by hand and titrated every thirty minutes, which describes the industry as it actually exists rather than as an automated ideal. A mid-size processor has a template today it did not have on Monday. But FDA is explicit that the wash is a cross-contamination control and not a lethality step, and its job is to keep one contaminated head from seeding the batch. Yuma in 2018 and Salinas in 2019 and 2020 walk through a flawless flume untouched. Keeping the wash from making things worse is worth doing. It is smaller than the page count suggests.

The same logic reaches the peppers. Antimicrobials do not reach what is internalized in the tissue, which is the entire answer to why no chlorine wash was ever going to save the jalapeños behind this summer’s Salmonella recalls. The wash is not the control. The supplier is. And nobody is testing the supplier’s water.

Guidance dockets never close. Comments on FDA-2018-D-3583 can be filed at any time, and there is one worth filing: name Chapters 19b and 19c in this document, and recommend testing supplier water and the growing environment as a verification activity. Not as a release criterion, because a negative can never clear a lot. As proof that somebody is looking. It took eight years to write down the hard half of the truth. The other half is that we have known how to find this thing in ten litres of irrigation water since 2020, and the guidance that admits the first half never mentions the second.

[1] Marion Nestle is the Paulette Goddard Professor of Nutrition, Food Studies, and Public Health, Emerita, at New York University, where she chaired the department from 1988 to 2003, and a visiting professor of nutritional sciences at Cornell. She was senior nutrition policy advisor at the Department of Health and Human Services from 1986 to 1988 and edited the 1988 Surgeon General’s Report on Nutrition and Health. She has written or edited fifteen books, among them Food Politics, Safe Food and Unsavory Truth, and she blogs at foodpolitics.com.

Todd Blanche was confirmed as Attorney General early Saturday morning on a vote of fifty to forty-nine. Among the many things he now runs is the criminal enforcement of the Federal Food, Drug, and Cosmetic Act. I have spent more than thirty years suing companies that poisoned my clients, and in all that time I have put one question to the Justice Department that has never been answered: when does making producing tainted food and making people sick become a crime?

I keep a slide for those questions. When I speak to industry groups, or teach, I put up the list of every American food company and every executive the United States has actually prosecuted. It is a short slide. It fits with room left over. This week I went back through it against the Department’s own press releases and the court records and found that my own list was missing several cases. Here is the corrected version, as complete as I can make it, together with the law that makes all of it possible.

Start with the statute, because it is not hidden in a regulation somewhere. 21 U.S.C. § 331 lists the prohibited acts, and the two that matter for food are subsection (a), introducing an adulterated or misbranded food into interstate commerce, and subsection (k), causing a food to become adulterated while it is held for sale. Section 333(a)(1) makes any violation a misdemeanor punishable by up to a year in prison. It requires no intent whatsoever. That is the whole point of it. Under United States v. Dotterweich in 1943 and United States v. Park in 1975, a corporate officer who stood in a position to prevent or correct the violation can be convicted for failing to do so, whether or not he knew a thing.

Section 333(a)(2) turns the identical conduct into a felony carrying up to three years, and it does so in exactly two circumstances: the defendant already has a final FDCA conviction, or the violation was committed with intent to defraud or mislead. That is the entire dividing line between a misdemeanor and a felony in food. Not the number of people hospitalized. Not whether anyone died. Whether somebody lied.

The dollar figures written into section 333 — a thousand dollars for the misdemeanor, ten thousand for the felony — are 1938 fossils, and nobody has paid them in decades. 18 U.S.C. § 3571 supplies the real numbers. An individual faces up to $100,000 on a Class A misdemeanor, and $250,000 if the offense is a felony or results in death. A company faces $200,000, and $500,000 for a felony or where death results. That last distinction matters more than it looks: the corporate ceiling only doubles if the government charges the misdemeanor as one that resulted in death, and it usually has not. Then comes subsection (d), the alternative fine: twice the gross gain, or twice the gross loss, whichever is greater. That subsection is where every large number in this piece comes from. The $25 million from Chipotle and the $41.675 million from Family Dollar are not statutory maximums under Title 21. They are twice-the-gain arithmetic.

Meat and poultry live under different statutes with the same architecture. 21 U.S.C. § 676(a) of the Federal Meat Inspection Act and § 461(a) of the Poultry Products Inspection Act both give one year by default and three years where the violation involves intent to defraud or the distribution of an adulterated article. Bribing a federal meat inspector is its own felony under § 622, and it carries something almost nothing else in food law does — a mandatory minimum of one year, a maximum of three, and a fine of not less than $5,000. It is worth being precise about that section, because it is easy to reach for and easy to get wrong. Quality Egg did plead to a bribery felony, but the charge came under the general federal bribery statute in Title 18, not under section 622, because the man taking the $300 was a USDA egg grader and not a meat inspector.

Both charges have been available since long before I was born, and the money is real. Almost every case below has a Justice Department press release behind it, and FDA keeps a standing index of the DOJ releases involving its Office of Criminal Investigations if you want the primary documents. Here is how often anyone has used the statute, oldest first.

1. Beech-Nut Nutrition Corp. (1987–89) — fake apple juice. The company pleaded guilty in November 1987 to 215 felony counts of shipping mislabeled juice with intent to defraud and paid a $2 million fine plus $140,000 in investigative costs, at the time by far the largest penalty ever paid under the Act. Two executives, president Niels Hoyvald and vice president John Lavery, were convicted at trial the following February, fined $100,000 each and sentenced to a year and a day. Neither served that sentence. In March 1989 the Second Circuit threw out every FDCA count on the ground that venue in the Eastern District of New York was improper, leaving standing only Lavery’s convictions for conspiracy and mail fraud. Hoyvald pleaded guilty to the food and drug charges that November and received five years of probation, 1,000 hours of community service and a $100,000 fine. There was no pathogen in this case at all. There was a lie, and the lie is what produced the felonies — and in the end the only convictions that survived appeal were the fraud counts, not the food counts.

2. Odwalla, Inc. (1998) — apple juice, E. coli O157:H7. Sixteen misdemeanor counts of delivering adulterated food, a $1.5 million fine — a quarter million of it earmarked for research and consumer education — and five years of probation, after unpasteurized juice killed a sixteen-month-old girl and sickened sixty-six other people in 1996. It was the largest criminal fine in FDA history at the time, and the first criminal conviction ever obtained in a large-scale pathogen outbreak. It established that a company could be convicted over a large outbreak without any proof of intentional wrongdoing, and nearly every case below is built on it. It was also my first.

3. Sara Lee / Bil Mar Foods (2001) — hot dogs and deli meat, Listeria. One misdemeanor count of preparing and selling adulterated meat and poultry, a $200,000 fine, a $3 million grant to Michigan State for food safety research, and $1.2 million to settle claims over product sold to the Defense Department. The outbreak killed at least fifteen people, caused six miscarriages and sickened around a hundred more, and forced the recall of 35 million pounds of product. The $200,000 was reported as the statutory maximum for a corporate defendant, and it was — for a Class A misdemeanor not charged as having resulted in death. Charged the other way, the ceiling would have been $500,000. The U.S. Attorney said there was no evidence the company knew, notwithstanding a USDA inspector’s account that management had stopped testing once the tests started coming back positive.

4. Jensen Farms — Eric and Ryan Jensen (2013–14) — cantaloupe, Listeria. A six-count Information, all misdemeanors, to which the brothers pleaded guilty on every count. They were sentenced to five years of probation each, the first six months in home detention, 100 hours of community service and $150,000 apiece in restitution — $25,000 per count, consecutive, paid to the victims. The Jensen brothers surrendered to U.S. Marshals and appeared in shackles, which nobody had ever seen in a misdemeanor food case. Their cantaloupe killed thirty-three people and sickened 147. The government presented no evidence that they knew, and none that they were chasing money. I have seen it written that they shipped melons they knew were contaminated. They did not. That is what makes the case matter — it is the purest Park prosecution on the list.

5. Quality Egg, LLC and Austin “Jack” and Peter DeCoster (2014–15) — shell eggs, Salmonella Enteritidis. The company pleaded guilty to two felonies — bribery of a public official, and introducing misbranded eggs into interstate commerce with intent to defraud — plus the strict-liability misdemeanor, and was sentenced to a $6.79 million fine, three years of probation and a $10,000 forfeiture. Father and son each pleaded to the misdemeanor as responsible corporate officers and drew three months in prison, a year of supervised release and a $100,000 fine apiece; the three defendants together owed $83,008.19 in restitution. The bribe at the center of it was $300 in petty cash, authorized by a marketing manager who pleaded guilty in 2012 and was sentenced to four years of probation. The Eighth Circuit affirmed the prison terms in 2016 over a dissent, and the Supreme Court declined to take the case. That decision is the single most important thing on this list: it holds that a food executive can go to prison for a crime that required no knowledge and no intent.

6. Peanut Corporation of America (2014–15) — peanut butter and paste, Salmonella. A federal jury convictedStewart Parnell of conspiracy, mail fraud, wire fraud, the sale of misbranded and adulterated food and obstruction — every count against him but one — and he was sentenced to twenty-eight years, the longest sentence ever imposed in a food safety case. His brother Michael, a broker, got twenty. Quality assurance manager Mary Wilkerson got five years for obstruction. The two plant operations managers who pleaded guilty and testified, Samuel Lightsey and Daniel Kilgore, got thirty-six months and seventy-two months. Nine people died and 714 were confirmed sick. This is the outlier that everyone cites and nobody replicates — and it is worth being precise about why it happened. The Parnells were convicted because they emailed each other about shipping product they knew had tested positive. The prosecution turned on fraud, not on contamination.

7. ConAgra Grocery Products, LLC (2015–16) — Peter Pan peanut butter, Salmonella. One misdemeanor count of shipping adulterated food. The Information and a pre-negotiated plea agreement were filed in May 2015; the company did not actually enter its plea and get sentenced until December 2016, when it paid an $8 million fine and forfeited $3.2 million more. At least 625 people in forty-seven states were sickened in 2006 and 2007. It took the Department more than eight years to bring the charge, and no individual was charged at all.

8. Rancho Feeding Corporation (2015–16) — beef, condemned and uninspected cattle. Not a pathogen case, but squarely a food crime, and charged under the Federal Meat Inspection Act at 21 U.S.C. §§ 610(c) and 676(a). Co-owner Jesse “Babe” Amaral Jr. got a year and a day for conspiring to distribute adulterated, misbranded and uninspected meat after directing employees to carve “U.S.D.A. Condemned” stamps out of carcasses and swap the heads of cancer-eyed cattle for healthy ones. His partner Robert Singleton got three months, and so did kill-floor foreman Felix Cabrera; the yardman drew probation and home detention. It triggered a recall of 8.7 million pounds. Judge Breyer called it one of the most calculated circumventions he had ever heard of, and noted it was only luck that nobody got sick.

9. Roos Foods, Inc. (2016) — Mexican-style cheese, Listeria. A misdemeanor plea and a $100,000 fine, plus a consent decree of permanent injunction against the company and its two principals. Eight people were sickened and one died.

10. Oasis Brands, Inc. and Christian Rivas (2016) — quesito casero, Listeria. Rivas pleaded to a two-count Information — Count 1 a felony under §§ 331(a) and 333(a)(2) for delivering adulterated cheese with intent to defraud and mislead, Count 2 the responsible-corporate-officer misdemeanor under § 333(a)(1) — and was sentenced to fifteen months in federal prison. He had promised the FDA he would stop shipping and then kept shipping. Five sickened, one dead. If you want a single document that shows how the felony and the misdemeanor differ, that charging Information is it.

11. Chipotle Mexican Grill, Inc. (2020) — multiple outbreaks. A criminal Information charging adulteration under the FDCA, a three-year deferred prosecution agreement, and a $25 million fine — at the time the largest ever in a food safety case. More than 1,100 people were sickened between 2015 and 2018. No executive was charged, and because it was a deferred prosecution, the company was never convicted of anything.

12. Blue Bell Creameries, L.P. and Paul Kruse (2020–23) — ice cream, Listeria. The company pleaded guilty to two misdemeanor counts and was ordered to pay $17.25 million in fine and forfeiture, plus $2.1 million to resolve False Claims Act allegations over product sold to federal facilities. Ten people were sickened and three died. The company’s former president was separately indicted on seven felony counts of wire fraud and conspiracy for allegedly concealing what the company knew. His 2022 trial ended in a mistrial with ten of twelve jurors voting to acquit, and in 2023 the government dropped the felonies in exchange for a plea to one strict-liability misdemeanor and a $100,000 fine. No jail.

13. Kerry, Inc. and Ravi Chermala (2023) — Kellogg’s Honey Smacks cereal, Salmonella. The company pleaded to a misdemeanor and paid $19.228 million in fine and forfeiture, then the largest criminal penalty ever imposed following a conviction in a food safety case. The outbreak sickened 135 people across thirty-six states and hospitalized thirty-four. The plant’s director of quality assurance pleaded to three misdemeanor counts, admitting that he had directed subordinates to withhold information from Kellogg’s and to alter the plant’s pathogen-monitoring program — one of the very few individuals below the C-suite ever charged. His plea agreement was one of roughly half a dozen documents sealed in the case.

14. Family Dollar Stores, LLC (2024) — a rodent-infested distribution center. One misdemeanor count of causing FDA-regulated products to become adulterated while held under insanitary conditions, and a fine and forfeiture totaling $41.675 million, the largest monetary criminal penalty in the history of food safety enforcement, plus three years of compliance obligations for Family Dollar and Dollar Tree. Fumigation of the West Memphis warehouse produced 1,270 dead rodents. Product had gone to 404 stores across six states. No outbreak was ever reported. Hold that thought.

15. Vulto Creamery, LLC and Johannes Vulto (2024) — raw milk cheese, Listeria. The company and its founder each pleaded guilty to one misdemeanor count of causing the introduction of adulterated food into interstate commerce. Environmental swabs at the Walton, New York plant had come back positive for Listeria species repeatedly from July 2014 through February 2017. Eight people were hospitalized and two died. Vulto was sentenced to three years of probation, a $100,000 fine and 240 hours of community service; the defunct company drew a year of probation. I have spent two decades collecting reasons why raw milk cheese is a bad idea. This is one of them, and it is the only raw milk case on the list.

16. Quality Poultry and Seafood, Inc., Mary Mahoney’s Old French House and four individuals (2024) — mislabeled fish. Not a pathogen case at all, and pay attention to the sentences. The largest seafood wholesaler on the Mississippi Gulf Coast pleaded guilty to selling cheap frozen imports from Africa, India and South America to restaurants as premium local species, a scheme that ran from 2002 to 2019 and kept running for more than a year after FDA agents executed a search warrant. QPS was sentenced to five years of probation, $1 million in forfeiture and a $500,000 fine. Sales manager Todd Rosetti got eight months in prison. Business manager James Gunkel got probation and home detention. Mary Mahoney’s, the Biloxi restaurant, paid nearly $1.5 million, and its co-owner drew probation, home detention and a fine. Nobody was made sick by any of it. The entire case file is public.

17. Valley Processing, Inc. and Mary Ann Bliesner (2024–25) — apple and grape juice concentrate. The company pleaded to conspiracy to introduce adulterated and misbranded juice; its eighty-three-year-old owner pleaded to two FDCA misdemeanors, including failing to register a food facility. Together they forfeited $742,139, and she was sentenced to probation. The indictment described concentrate stored outdoors in barrels for years, blended with fresh product and sold under new lot numbers to customers who supplied the National School Lunch Program. FDA photographed a rat floating on the crust of a juice tank. Nobody is known to have gotten sick, and this one happened forty miles from where I take depositions.

18. Abuelito Cheese, Inc. (2026) — queso fresco, Listeria. The most recent case on the list. The company pleaded guilty in Newark on May 21 to introducing adulterated food into interstate commerce under §§ 331(a) and 333(a)(1). FDA had swabbed the plant in early 2020, found Listeria and warned in a June 2020 letter that conditions were conducive to Listeria monocytogenes. The outbreak came in February 2021 — thirteen hospitalized, one dead across four states. Under the plea agreement the company will pay a $487,754 fine and forfeit $658,430, a total of $1,146,184, with sentencing set for October 15, 2026. Note where the file now sits: the case page is the Criminal Division’s, not the Civil Division’s.

Eighteen. In forty years. Against an industry that, by CDC’s own estimate, sickens forty-eight million Americans every year, hospitalizes 128,000 of them and kills three thousand. Eleven of the eighteen were resolved as misdemeanors or, in Chipotle’s case, with no conviction at all. Add up every American who has ever served a day of federal prison time over food, and you get twelve people: Stewart and Michael Parnell, Mary Wilkerson, Samuel Lightsey and Daniel Kilgore, Christian Rivas, Jesse Amaral, Robert Singleton and Felix Cabrera, Jack and Peter DeCoster, and Todd Rosetti. Twelve names in four decades, and five of them came out of a single peanut plant in Blakely, Georgia.

Look at what does and does not move the Department, because it is not what anyone in the industry thinks it is. Jensen Farms killed thirty-three people and the brothers got probation. Blue Bell killed three, and its chief executive paid a hundred thousand dollars after a jury declined to convict him of fraud. Johannes Vulto killed two and got probation and community service. Family Dollar did not sicken a single reported person and paid the largest criminal penalty in the history of the field. Todd Rosetti did not sicken anyone either, and still went to prison for eight months over fish labels. The variable is not the body count. It is whether a prosecutor can prove somebody lied — and after that, whether the lie is easy to photograph. A rat on a pallet is easy. A grouper that is really swai is easy. An unvalidated wash step is not.

Here is what I am asking of the new Attorney General, and none of it requires legislation or money.

Publish the charging guidelines. I asked for this in Forbes in July 2015 and again that June, and eleven years later there is still nothing public that explains why the Jensen brothers went before a magistrate in shackles while companies with far worse compliance records never heard from anyone. It used to be closer. The old U.S. Attorneys’ Manual carried sections on felony charging for intent to defraud, Park misdemeanor liability and food fraud prosecutions. The current Justice Manual, last updated in January 2021, dropped all three. What is left is a consultation rule telling a U.S. Attorney’s office when to call Washington — Park liability, death or serious bodily injury, more than $100 million at stake, fraud on the FDA — and it says nothing about when to charge. Deterrence you cannot predict is not deterrence.

Tell us who does this work now. The Consumer Protection Branch, which held the FDCA authority under 28 C.F.R. § 0.45(j), was dissolved on September 30, 2025. Its criminal food work moved into a new Health and Safety Unit inside the Criminal Division’s Fraud Section, stood up on November 30, 2025 with twenty-three prosecutors carried over from the Branch, while the Civil Division’s new Enforcement Section kept concurrent authority to investigate and prosecute the same FDCA crimes. Two components, one statute, and no published division of labor. Reuters counted about 215 people at the Branch when the disbanding was announced, but that number covered attorneys, support staff and agents together and the Department has published no comparable count for the new unit, so how much was actually lost is something only the Department can say. Meanwhile the Justice Manual still tells prosecutors to consult the Branch, at 9-99.000 and again in the CHIP guidance the Department itself updated in January 2026, months after the Branch stopped existing. Publish the new unit’s authority and its head count and fix the Manual. Every case on the list above was worked by an office that is no longer there.

Say whether the Park misdemeanor is still charged. For fifty years the industry has been told that a responsible corporate officer can be convicted without knowledge or intent. The DeCosters went to prison on that theory in 2015 and the Eighth Circuit blessed it, and so far as the public record shows nobody has gone to prison on it since — though I cannot say that with certainty, because at least one sentence, Ravi Chermala’s, was never announced. People do still plead to it. Johannes Vulto did, Mary Ann Bliesner did, and both drew probation. If probation is now the ceiling, say so, because right now every food safety consultant in America is selling the risk of a prison term and nobody knows whether that risk is still real.

Ask the President to take food out of Executive Order 14294. You cannot revoke it yourself and I am not pretending otherwise. But the order, signed on May 9, 2025 — two weeks after Reuters reported that the Consumer Protection Branch was being disbanded — declares that criminal enforcement of regulatory offenses is disfavored, that strict liability offenses are “generally disfavored,” and that prosecutions should focus on defendants alleged to have known their conduct was unlawful. Section 8 already exempts immigration and national security from all of it. Food can be exempted too, and you are the one who can ask. Until then there are two things you can do without asking anybody. The first is to state in writing that the food misdemeanor is not covered, because section 3(b) of the order defines a criminal regulatory offense as a federal regulation enforceable by a criminal penalty, and section 333(a)(1) is a statute. The second is to explain section 4(d), which tells you to consider whether an offense appears on an agency’s published list before you open an investigation or bring a charge. HHS filed its list on May 8, 2026, in consultation with your Department: FDA reported fourteen criminal regulatory offenses, seven of them strict liability, and the Department set down as a policy determination that it will evaluate alternatives to strict liability criminal enforcement. I wrote when the order issued that Blue Bell, Kerry, ConAgra, Chipotle, Wright County, Odwalla and Jensen Farms would probably never have been charged under it, and I wrote it again in December. I would like to be wrong.

I have built a career on a system that pays my clients after they are hurt. It is a poor substitute for not hurting them. Every food safety executive I have ever deposed has told me some version of the same thing: the budget requests get approved after somebody gets prosecuted, not after somebody gets sick. Eighteen cases in forty years is not a deterrent. It is a lottery, and the industry has learned to play the odds. Attorney General Blanche, prove me wrong.

By the way, if you need a lawyer to run the shop, I know one.

In twenty-four days, the same company has turned up at the center of two separate federal foodborne illness investigations. One is the largest Cyclospora outbreak this country has ever recorded. The other is a Salmonella Javiana outbreak that has sickened 345 people in 27 states. That does not happen to most produce companies in a decade. It has happened to Taylor Farms in a month, and the two are not the same kind of problem. I represent people sickened in these outbreaks and in several of the older ones below. That is a disclosure.

Start with the lettuce. FDA’s advisory, last updated August 5, counts 6,358 illnesses in fifteen states, at least 278 hospitalizations and two deaths in Michigan, with onsets from June 22 through July 31. CDC’s outbreak page carries the same figures. Those are laboratory-confirmed cases tied to Taco Bell or the recalled lettuce. My own fifty-state chart, built from what the states publish about themselves, stood at 27,937 cases across thirty-eight states last night. Maine became the sixteenth outbreak state on Friday, in a formal advisory from its own health department, and the federal count still says fifteen.

The recall behind it was announced July 17 by Taylor Farms de Mexico, out of the Doctor Mora plant in Guanajuato. FDA’s own enforcement file runs to twenty-one entries and 236,192 cases of lettuce, sold to nine customers including Subway, Sysco, US Foods and Walmart’s Marketside label.

Now the peppers, and here I am going to be fair before I am critical. Taylor Farms did not grow these jalapeños. A grower in Sinaloa did. Coast Citrus Distributors of San Diego imported them and sold them to wholesalers, restaurants and processors. FDA’s traceback converged on that grower, FDA recommended that Coast Citrus recall, and Taylor Fresh Foods recalled its own finished products on August 9 after its supplier notified it. On the jalapeños, Taylor Farms is a buyer handed a contaminated ingredient, the same as Chipotle and Kroger, and anyone reading a list of recalled salsa should understand that first.

What is worth writing about is the scale. Twenty products came off the shelf, into Hannaford, Kroger, Stop and Shop, Target, Trader Joe’s, Walmart and Whole Foods, and into distribution centers in twenty-six states. USDA issued a separate public health alert the day before for meat and poultry made with the same peppers, most of it out of Taylor Farms plants. One grower in Sinaloa, one importer in San Diego, and within a weekend the list reaches seven of the largest grocery banners in the country.

Count the products on that list with Taylor Farms on the package. There are five, all at Target. The other fifteen are Private Selection, Freshness Guaranteed, Trader Joe’s, or carry no brand at all. A shopper holding a tub of Kroger Spicy Pimento Cheese Dip has no way of knowing who made it. That is the private label business working as designed, and it is why telling people to check the refrigerator is not a plan.

And FDA still has not named the Sinaloa grower. It named Coast Citrus. Its advisory names Chipotle and QDOBA, and CDC’s investigation page counts twenty-seven illness clusters at those chains. The grower whose peppers are the reason for all of it stays confidential, while in the Cyclospora advisory FDA put Taco Bell in the first sentence and Taylor Farms de Mexico in the headline. I cannot find the principle that produces both results.

Anna Skinner at Newsweek published a timeline of Taylor Farms recalls and outbreaks on Monday that goes back seventeen years, and she deserves credit for how she did it. She built it partly off a review I put together, then did the harder half of the job. She called the company and printed its answer in full. She printed the entries Taylor Farms disputes and said so plainly.

Four days earlier CNN published an investigation of its own, by Casey Tolan, Yahya Abou-Ghazala, Curt Devine and Kyung Lah, arguing that this outbreak follows a years-long pattern of deflected blame. The key finding came from a former senior FDA food official, who told CNN that the 2024 McDonald’s onion investigation was a slam dunk and that Taylor Farms went to considerable lengths to keep the agency from naming it publicly. It did not work that time. Nobody had to make that argument about the 2024 romaine outbreak, because no agency named anyone at all.

CNN also put numbers on the oversight. FDA has not inspected the Guanajuato plant since 2019, and in the first half of this year five of the company’s more than 160,000 Mexican shipments were physically examined. Taylor Farms’ Mexican subsidiaries are the largest source of vegetable and salad shipments into this country of any manufacturer in the world.

In 2013 Bruce Taylor said the tests were negative and there was no evidence of Cyclospora in the product. In 2015, after a Montana laboratory found E. coli in the celery and onion mix behind the Costco outbreak, the one that put two children into kidney failure, he told the Monterey Herald it looked like a false alarm. In 2024 the company said its testing found no traces in the onions, in an outbreak that killed a man in Colorado. In 2026 it went to a false positive on a single border sample. Four outbreaks, one answer: the testing was clean. It is clean because people eat the evidence. A negative result on what is left in the cooler is not a finding of innocence.

The Newsweek timeline repeats that FDA apologized over the false positive. That apology is the company’s own characterization, from its July 19 statement. FDA’s record contains a laboratory correction and no apology; CNN reports the agency denied apologizing, and the company took its social media post down. In the same update FDA said it was continuing to work with the firm to remove product implicated in the outbreak. The word implicated survived the retraction.

Here is the company’s position, stated fairly. Taylor Farms says it invests more than $200 million a year in food safety, that it acted voluntarily and more broadly than asked on the lettuce, and that it put traceback protocols in place ahead of the Food Traceability Rule deadline. Take that last claim at face value and two questions have documented answers in its own files. How many days passed between the first Sinaloa pepper entering a Taylor Farms plant and the recall list being published, and how many between FDA’s first call about iceberg lettuce and the July 17 removal? A company with real time traceability can answer both in an afternoon.

What I want out of August is short. FDA should classify the July 17 lettuce recall, which three weeks on is still marked Not Yet Classified and has therefore never appeared in a weekly enforcement report. FDA should name the Sinaloa grower. Recall notices should carry customer names rather than brand codes, so buyers two steps down the chain know what is in their walk-in. And Taylor Farms should produce the water testing records and the adjacent land reviews for the Doctor Mora ranches, because its own website says both exist.

The fifty state health departments now report 27,937 cases of cyclosporiasis this season, up 1,182 from the 26,755 published on August 7. Ten states moved, and Maine appears on this chart for the first time. Indiana went to 1,893, Missouri to 1,577, Kansas to 615, Florida to 342, West Virginia to 291, Arkansas to 252, Wisconsin to 216, Virginia to 162 and Maine to 27, while Nebraska reached 218. Washington revised down by two. 

No federal number moved. FDA and CDC both still report 6,358 illnesses, 278 hospitalizations and two deaths in fifteen states, stamped August 5. CDC’s national surveillance page still reads 10,468 laboratory-confirmed plus more than 12,255 not confirmed, a total of 22,723, and has not changed since August 4. The states are now 5,214 cases ahead of that figure. CDC updates again Tuesday.

The thirteen states that publish a hospital figure now total 683 between them, after West Virginia moved from 20 to 21 and Wisconsin from 3 to 5. CDC’s national surveillance says 517 for the entire country. The federal figure for this outbreak is 278, and Michigan by itself reports 279. Thirty-seven states publish no hospital figure at all.

Where all fifty stand

The last column of this chart is new. It is that state’s entire 2025 total from CDC’s weekly notifiable-disease tables, which is a different series from the state figures beside it. It counts travel-associated cases and covers a full calendar year against a season still running. It is there for scale, not for arithmetic.

State2026 casesAs ofAll of 2025Lettuce
Michigan12,485Aug 650Yes
Ohio4,900Aug 476Yes
Indiana1,893Aug 1027Yes
Missouri1,577Aug 9none reportedYes
Illinois995Aug 4301Yes
North Carolina867Aug 4300Yes
New York753Jul 27694Yes
Kentucky620Jul 2945Yes
Kansas615Aug 529Yes
Oklahoma426Aug 441Yes
Florida342Aug 1210Yes
West Virginia291Aug 78Yes
Arkansas252Aug 1013Yes
Iowa226Jul 3064Yes
Nebraska218Aug 651No
Wisconsin216Aug 565Yes
Texas198Aug 5512Yes
Virginia162Jul 30115Yes
Colorado150Jul 17205No
Massachusetts145Aug 574Yes
Alabama85Aug 319Yes
Pennsylvania82Jul 29not notifiableYes
Maryland69Jul 17123Yes
New Hampshire69Aug 47Yes
New Jersey46Jul 11180Yes
California41Jul 14not availableNo
Minnesota41Jul 17none reportedNo
Washington36Aug 7not availableNo
Connecticut35Jul 1741Yes
Maine27Aug 74No
Oregon23Jul 24not availableNo
Arizona19Jul 1749No
Georgia11Jul 17116Yes
Tennessee11Jul 1738Yes
Alaska5Jul 166No
Rhode Island4Jul 176No
Louisiana1Jul 1799Yes
Utah1Jul 1737No
Delawareno count published—1No
Hawaiino count published—not availableNo
Idahono count published—not notifiableNo
Mississippino count published—not notifiableYes
Montanano count published—8No
Nevadano count published—not notifiableNo
New Mexicono count published—9No
North Dakotano count published—4No
South Carolinano count published—45Yes
South Dakotano count published—3No
Vermontno count published—3No
Wyomingno count published—0No
All fifty states27,937  50

What the 2025 column shows

Michigan reported 50 cases in all of last year and has reported 12,485 this year. Ohio reported 76 and is at 4,900, the sixty-four times figure its own health department has used. Indiana reported 27 and is at 1,893. West Virginia reported 8 and is at 291. Arkansas reported 13 and is at 252. Kentucky reported 45 and is at 620.

The same column shows which states are not unusual, and that has to be said. Texas reported 512 cases in 2025 and is at 198 this year. Colorado reported 205 and is at 150. Louisiana reported 99 and has published a single-digit count. Maryland and New Jersey are both running below last year. Not every state on this chart is having an outbreak, and the chart should not be read as though they are.

Four states do not make cyclosporiasis notifiable at all, so no figure exists to compare: Pennsylvania, Idaho, Mississippi and Nevada. Twelve states have published no 2026 count. Two of those, Mississippi and South Carolina, received the recalled lettuce.

What this figure is, and what it is not

27,937 is a floor, not an estimate. It is the sum of what fifty health departments have published, on schedules running from weekly to never, with four states reporting only a range that I count at the bottom. Where a state publishes two series, I use the one this chart has always used: for Florida that is the since-May-1 figure of 342 rather than the calendar-year 352, and for New York the since-May-1 figure of 753 rather than 787. Ohio and Iowa and Kansas and Arkansas are calendar-year, because that is the series those states publish.

Most people with cyclosporiasis never get a stool test, because the parasite is missed by the routine ova and parasite exam and has to be requested by name, and because people with a diarrheal illness that comes and goes for a month often never see a doctor. The standard estimate of that gap comes from Scallan and colleagues, Foodborne Illness Acquired in the United States, Major Pathogens, in Emerging Infectious Diseases in 2011, which puts the underdiagnosis multiplier for Cyclospora at 83.1. Applied to CDC’s 10,468 laboratory-confirmed cases, that puts the real number near 870,000.

Between July 14 and July 30, members of the House and the Senate wrote eleven separate letters about the Cyclospora outbreak. Five came out of the House and six out of the Senate. They went to the acting head of CDC, to the acting commissioner of FDA, to the Secretary of Health and Human Services, and twice to the chief executive of Taylor Farms. Four of them set a deadline that has now passed. Three more come due in the next four days. As of this morning I cannot find a published answer to a single one.

Start with the credit, because it is owed. A letter from a member of Congress is not a subpoena and it is not a rule, and I have spent thirty-three years watching letters like these go into a drawer. But a letter puts a specific question in writing with a name underneath it, and it creates a date on which somebody either answered or did not. Every one of these members chose to spend staff time and political attention on a parasite that most of the country had never heard of in May. Foodborne illness does not usually get eleven letters in seventeen days. This time it did, and the people who wrote them were right to.

The first came from Senator Amy Klobuchar of Minnesota on July 14. She wrote to the acting heads of CDC and FDA asking them to restore FoodNet, the Food Emergency Response Network, the Food Safety and Inspection Service, the Public Health Infrastructure Grants and the Preventive Health and Health Services Block Grant. Her sharpest observation is that there is no longer a central place to report and compare data across state lines, which is exactly the problem every count in this outbreak has run into since. She set no deadline.

Representative Greg Stanton of Arizona wrote to Secretary Kennedy on July 15 with six questions and asked for answers by August 3. Who directed the decision to cut FoodNet’s required surveillance, and what scientific or budget analysis supported it. What funding has been reduced or redirected since January 2025. How many surveillance staff have been terminated, reassigned or left vacant. What system now performs the active laboratory outreach FoodNet used to do. How many personnel are assigned to the federal response. And what evidence supports the department’s claim that none of these changes affected this investigation. That last one is the best question anybody has asked, and August 3 came and went.

Senator Jon Ossoff of Georgia wrote to Kennedy on July 16 with three questions and gave him seventy-two hours. Has FoodNet been restored to require tracking of Cyclospora cayetanensis, and if not, why was it terminated, and what is the status of the epidemiological and food safety investigations. He wrote that the demolition of these programs puts Americans at risk, and he was working off CDC’s confirmed count of 1,645 at the time.

Eight days later he had to write again, and that second letter is the reason I am writing this one. On July 24, having received nothing, Ossoff sent a second letter telling the Secretary that seventy-two hours had passed, that his questions had not been addressed, and that silence during an outbreak of diarrheal disease is its own kind of answer. By then he was citing more than 11,000 cases across forty-one states. A United States senator asked three plain questions, got nothing, and had to spend a second letter saying so. Nobody should have to do that twice.

The best letter of the eleven came from Michigan on July 17, and it is the best one because it was written from inside the outbreak. Representatives Debbie Dingell, Kristen McDonald Rivet, Hillary Scholten and Rashida Tlaib sent ten questions to CDC and FDA and asked for answers by July 24. Do you agree with Michigan that lettuce and salad greens are the source. What barriers are preventing you from acting on the leads Michigan has developed. How many federal personnel are assigned to this compared with outbreaks of similar size in the past five years. Those are the questions of people whose constituents are the ones in the hospital beds. July 24 passed without a reply.

Representative Josh Gottheimer of New Jersey wrote to CDC on July 20 asking that FoodNet be restored to full mandatory active surveillance, and paired the letter with two bills. The Foodborne Illness Rapid Response Act, written with Representative Don Bacon of Nebraska, would bar staffing cuts in the CDC divisions responsible for foodborne illness surveillance for a year after an outbreak is detected. The second would let state and local inspectors see the same unredacted inspection information federal regulators see, which matters because state and local inspectors do roughly sixty percent of the food processing inspections in this country. Neither bill has a number yet. Bacon is the only Republican name attached to anything in this file.

Senators Richard Blumenthal and Cory Booker asked CDC for a briefing that same week, wanting to know how the outbreak was tracked and whether federal staffing cuts caused the delay, with answers by the end of the following week. I have never been able to find a copy of that letter; it exists in the reporting and not in any archive I can reach, which is its own small problem when the point is accountability.

On July 27 the letters changed character. Representative Robert Garcia of California, ranking member of the House Oversight and Government Reform Committee, wrote to Taylor Farms chief executive Bruce Taylor — the first letter in this outbreak addressed to a company rather than to the government. He asked for five categories of documents by August 10: all communications with FDA, CDC and USDA since May 1; all communications with the White House since January 21, 2025; all internal communications about the outbreak; everything concerning the July 17 recall; and every inspection, audit, risk assessment and contamination record for Taylor Farms de Mexico going back to January 1, 2013. That last date is not an accident. It reaches back to the 2013 outbreak traced to the same Mexican growing region.

Three days later Blumenthal wrote twice more, and these two are different from everything before them. Writing as ranking member of the Senate Permanent Subcommittee on Investigations, he sent one letter to the acting FDA commissioner and a second to Bruce Taylor, both dated July 30, both due August 13, both copied to Chairman Ron Johnson. Both demand all communications with the White House, expressly including the Executive Office of the President and the Domestic Policy Council, and all communications between the agency and the company. The records definition names Signal and WhatsApp by name, which tells you the subcommittee has done this before. It matters that these came from that subcommittee: it is the Senate’s standing investigative body, it has subpoena capacity, and it is the same subcommittee that held a hearing on Cyclospora in imported raspberries in July 1998. Twenty-eight years, same subcommittee, same parasite.

The eleventh is the largest by signatures and the weakest by mechanism. On July 30, Representatives Marc Veasey of Texas, Debbie Dingell of Michigan and Terri Sewell of Alabama led about fifty colleagues in a letter to CDC and FDA asking for transparency and immediate action to identify the source. Veasey’s line is that public health decisions should be guided by science and transparency and not by outside influence, which is the same accusation Blumenthal makes with names attached. Fifty-three members signed it. It sets no deadline and demands no documents, and that is the difference between a pressure letter and an investigation.

Here is the whole set on one page.

Who wroteSentWritten toDeadlineStatus as of August 9
Sen. Amy KlobucharJul 14CDC and FDANone setNo answer found
Rep. Greg StantonJul 15HHS Secretary KennedyAug 3Passed, no answer found
Sen. Jon OssoffJul 16HHS Secretary Kennedy72 hours (Jul 19)Passed, no answer found
Reps. Dingell, McDonald Rivet, Scholten, TlaibJul 17CDC and FDAJul 24Passed, no answer found
Rep. Josh GottheimerJul 20CDCNone setNo answer found; two bills, no numbers yet
Sens. Blumenthal and BookerJul 20CDCEnd of that weekPassed, no answer found
Sen. Jon Ossoff (second letter)Jul 24HHS Secretary KennedyRestates the firstNo answer found
Rep. Robert Garcia, Oversight ranking memberJul 27Taylor Farms CEO Bruce TaylorAug 10Comes due Monday
Sen. Blumenthal, PSI ranking memberJul 30Acting FDA Commissioner DiamantasAug 13Comes due Thursday
Sen. Blumenthal, PSI ranking memberJul 30Taylor Farms CEO Bruce TaylorAug 13Comes due Thursday
Reps. Veasey, Dingell, Sewell and ~50 colleaguesJul 30CDC and FDANone setNo answer found

Two cautions about that table, and I would rather say them myself than have somebody find them for me. The first is that I believe it is every letter and I am not certain that it is. I built it from press releases, from the letter PDFs where offices posted them, and from news reporting where they did not, and a letter that went out quietly without a release is a letter I would not have seen. The second is the status column. It says no answer found, and that is exactly what it means and nothing more. An agency can respond to a member of Congress privately, and often does, and neither the agency nor the member has any obligation to publish it. What I can tell you is that I looked and found nothing published. If a member sent a letter that is not on this list, or if any of these eleven has been answered and I missed the answer, send it to me and I will correct this post and say plainly that I had it wrong. The list of answers is the part I would like to see grow.

There is something in that set that should worry every member who signed. Look at the numbers the letters themselves carry. Gottheimer’s announcement on July 20 described roughly 7,000 cases across thirty-four states. The fifty-three-member letter of July 30 described more than 4,000 cases and more than 300 hospitalizations. On July 29 the states were reporting 21,452. A letter signed by fifty-three members of Congress described an outbreak about a fifth the size of the one the states were counting. That is not a criticism of the members. They used the published federal numbers, because those are the numbers a congressional office is supposed to be able to rely on. The counting failure I have been writing about all summer has now reached the legislature itself, and the people writing the oversight letters are working from a picture the system gave them.

All eleven letters were written by Democrats. Don Bacon cosponsors a bill and Senator Bill Cassidy raised the outbreak in a hearing he was chairing, and that is the entire Republican presence in this file after eight weeks. Foodborne illness has historically been the least partisan subject in Washington, and it is worth remembering how recently that was true. Rosa DeLauro wrote FDA and CDC in August 2013 asking whether it is acceptable to identify the source of a Cyclospora outbreak and then withhold it from the public — during the outbreak traced to this same Mexican facility — and she wrote FDA again in August 2018 on the Fresh Express outbreak to say the timeline did not instill confidence. Thirteen years and eight years ago, the same questions. Nobody answered those either.

Six of the eleven aim at FoodNet, and FoodNet is the wrong instrument. It measures trends across about sixteen percent of the population; the systems that actually detect an outbreak are NNDSS and PulseNet. Restoring FoodNet is worth doing and it would not have found this outbreak a day sooner. Garcia’s letter is the only one of the eleven to name the Food Traceability Rule, which is the rule that would let anyone follow a bag of lettuce from a field in Guanajuato to a restaurant in Michigan, and which Congress has now directed FDA not to enforce before July 2028. If a member wants one thing to ask for that would change the next outbreak, that is the thing.

That brings me to the ask. A deadline with nothing behind it is a suggestion, and four suggestions have now expired. The Permanent Subcommittee on Investigations has subpoena power and a Republican chairman who has been copied on both letters. The Oversight Committee’s majority can join Garcia’s request and make it the committee’s request instead of the ranking member’s. Appropriations season is open. Any member who signed one of these letters can put the same question to the acting commissioner in a hearing, on the record, where not answering is visible. What should not happen is that August 13 goes by the way August 3 went by, and the next letter starts with the words seventy-two hours have passed.

The season closes on August 31. Taylor Farms has suspended its central Mexico iceberg sourcing until then, which means the natural end of this outbreak is going to arrive before any of these questions are answered, and an outbreak that ends is an outbreak that stops making news. Two people are dead in Michigan. The states have counted 26,755 sick. The federal government counts 6,358 in fifteen states, which is the number that will end up in the history of this thing unless somebody makes the agencies explain the gap. Eleven letters is not nothing. Eleven letters and no answers is a lesson, and the people who wrote them are the only ones in a position to make sure it is not the lesson that sticks. Thank you for writing. Please do not let it end there. I am watching, and so are twenty-six thousand seven hundred and fifty-five other people, and not one of us chose to be part of this.

Sarah Despres and Susan Mayne got to this before I did, on LinkedIn, and they answered it better than I would have. Credit where it belongs. Both have been steady, sourced, unglamorous voices through this outbreak while a great many louder people have not.

Here is what they were answering. Calley Means — senior adviser at the Department of Health and Human Services, one of the administration’s leading voices on food, the man generally credited with brokering the Trump–Kennedy partnership — posted on X that whenever you read about the Cyclospora outbreak, you should know that junk food companies are paying millions of dollars to spur “this hysteria” to get you to eat less real food. There are Cyclosporaoutbreaks every year, he wrote. This is the first year there is a media frenzy. The post quotes an earlier one of his own saying those companies are funding a fake “food borne illness advocacy” group to feed quotes to reporters attacking the real food agenda. Attached to it is a sheet of corporate logos belonging to the Alliance to Stop Foodborne Illness. Eighty-five thousand views and climbing.

Despres put the shape of it plainly: a senior White House official asserting that concern over the largest Cyclosporaoutbreak ever recorded in this country — one that has killed two Americans — is hysteria manufactured by the very food companies the outbreak is financially wrecking. A weird conspiracy theory, she called it, and one that suggests a cavalier attitude toward legitimate food safety problems. She also notes that in an earlier post he described this outbreak as a couple of cases of diarrhea.

Mayne answered the specific slander, and she is the right person to do it. She ran FDA’s Center for Food Safety and Applied Nutrition from 2015 to 2023. Stop Foodborne Illness, she wrote, is a thoroughly legitimate nonprofit public health organization devoted to preventing illness and death from contaminated food. She has known the group for years, long before anyone had heard of this outbreak. And she described what is on the walls of their offices: photographs of the faces of children who died of foodborne illness, hung there as a standing reminder of why the work matters, because it could have been anyone’s child. STOP works with consumer advocates and with industry, she wrote, because food safety has to be a shared responsibility.

Noble organization, noble mission.

That was her closing line, and I would not improve on it. Despres added that she has worked with STOP’s chief executive, Sandra Eskin — until recently the Deputy Under Secretary for Food Safety at the United States Department of Agriculture — and that Eskin has the record to back the commitment. I have watched this organization for three decades. Nobody bought it. It was built by people who arrived the hard way, carrying photographs.

Now take the accusation seriously enough to check it, because it collapses on the evidence Means chose himself.

The Alliance is not the same thing as Stop Foodborne Illness, and he has run the two together. It is a program housed inside STOP, launched in 2018 with ten companies and now at twenty-five industry partners, organized around food safety culture. Member companies pay in. That is a fair thing to disclose and a fair thing to argue about — I have spent years being skeptical of industry-funded food safety work and I will keep being skeptical of it. But disclosure is not fabrication. Saying a group takes corporate money is a criticism. Saying it does not really exist is a fantasy.

And look at whose logos are actually on the sheet he posted as proof. In December of last year, the Alliance added five members: Amazon, Amerisan, the Meat Institute, Mérieux NutriSciences, and Yum! Brands. Yum! Brands is Taco Bell. Its logo sits in the middle of the image he tweeted. So, the theory is that the corporate parent of the restaurant chain at the dead center of this outbreak — the chain whose sales have taken the hit, whose franchisees are named defendants in lawsuits my firm has filed — is quietly financing the panic about itself. The National Restaurant Association is on that sheet too, which is to say the trade association whose entire job is defending restaurants from exactly this kind of story. Walmart is on it, and Walmart sold the recalled Marketside lettuce. These are not the beneficiaries of lettuce fear. These are its casualties. That is Despres’s point about the illogic, and it is fatal to the whole theory.

The line about every year is true and useless. There are Cyclospora cases every summer; I have been writing about them since the 1990s. The reason there is a frenzy this year is that the numbers are not last year’s numbers. CDC now counts 6,358 illnesses across fifteen states in the lettuce outbreak alone, with at least 278 hospitalizations and two deaths in Michigan, while the states themselves report more than twenty thousand confirmed and suspected cases nationally. It is the largest Cyclospora outbreak this country has ever recorded, by a wide margin. Using an accurate background fact to launder away a foreground one is an old trick. Yes, there are outbreaks every year. There has never been one like this. It is not a couple of cases of diarrhea.

There is a real concern buried under the conspiracy framing, and Mayne got there first and got there better. In an essay in STAT she wrote that consumers should not be faced with a trade-off between nutrition and food safety. That is the legitimate version of the point. People do flee produce after a leafy green outbreak. They go to the pizza and the Doritos and tell themselves an Oreo never gave anybody explosive diarrhea, and they end up differently sick on a longer timeline from something that will never make the news. Nobody wins that trade, and I have watched it happen after every one of these for thirty years. But Mayne names the cause, and the cause is not a cabal. She has been documenting it week after week — career staff shown the door, the advisory committee disbanded, the joint work with Mexican counterparts ended, FoodNet cut from eight pathogens to two with Cyclospora among the six dropped, the traceability rule pushed to 2028. Asked on CBS Sunday Morning whether an outbreak next year could be traced, she said it could not. Her verdict was that this is a national wake-up call.

Despres has been asking the accountability half of the question, and she has the background for it — fifteen years of congressional oversight work, then Pew, then four years as Counselor for Public Health and Science in the Secretary’s office at HHS. Back on July 18 she asked publicly whether the Secretary was pushing Taylor Farms to be more transparent, given that the company was not making its customer list public. Three weeks later that is still the live question, and it has only sharpened as CNN documented the company’s long history of deflecting after outbreaks. Note what the two women have in common. Neither is asking the public to distrust vegetables. Both are asking the government to do the work that would let people trust them.

One last thing, and it is the part that bothers me most. Asked about this outbreak by a reporter this same week, Means said, “I don’t have a comment on cyclospora,” and that he did not want to get into it. No comment for the reporter. Eighty-five thousand views for the conspiracy theory. Two people are dead in Michigan and hundreds have been hospitalized, and the response from a senior official in the department that runs both CDC and FDA is that their families are props in a marketing campaign paid for by Costco and Hershey.

Understand where this criticism is coming from, because it is not coming from outside the tent. I have spent years arguing that the American diet is making people sick, that ultra-processed food is a public health problem, and that whole food is better food. Marion Nestle, who has taken more incoming from this administration than almost anyone, has said flatly that she is not MAHA’s enemy and supports parts of its agenda. Mayne’s whole argument is that nutrition and food safety rise and fall together. The people pushing back hardest on Means this week are not the opponents of eating real food. They are the ones who would have to make it actually work — and who know that it cannot work while the surveillance system that keeps real food from killing people is being taken apart.

That is why this matters beyond one bad tweet. The administration needs serious people advising it on food. There is real work available here — restore Cyclospora to FoodNet, stop delaying traceability, publish one national number the public can rely on — and none of it is partisan. An adviser who spent this week on that instead of on a conspiracy theory about Costco and Hershey would have my support and my thanks. Calling the parents of dead children a front group is not serious work. It is not even in the neighborhood of serious work.

Despres ended her post by saying it appears the White House is not taking this outbreak seriously, but that she is glad FDA’s career staff and outside groups are. That is about where I land too. I am not asking Means to agree with me about FoodNet, or traceability, or who should pay for what. I am asking him to look at the logo sheet he posted. Taco Bell’s parent company is on it. And somewhere on a wall in Chicago there are photographs of children, hung by the people he just called fake.

Three weeks ago, Taylor Farms recalled iceberg lettuce from its plant in Doctor Mora, Guanajuato. The July 17 notice named no customers, published no volume, and identified the buyers only by eight two-letter codes. Everything it left out has been sitting in FDA’s recall enterprise database since the day the recall was announced, in a record called Event 99453. Twenty-one separate product entries. I first went through it by hand today, one entry at a time, and then found there is an export button that hands you all twenty-one at once. Here is what is in it.

The recall covers 236,192 cases. That figure appears nowhere — not on FDA’s website, not in the company’s announcement, not in any story I have read. FDA’s system does not total the entries. It lists them, each with its own case count, and there is no sum anywhere on the screen. Nobody had to decide to withhold the number. It does not exist until somebody sits down and adds it up.

Start with the names, because that is the part that should never have taken three weeks. The public got CV, JB, MARK, MKTSD, PK, SUB, SY and TF. The federal record spells them out: Cross Valley Farms, which is US Foods’ private label; Marketside, which is Walmart’s; Markon; Peak; Sysco; Jack in the Box; Yum; Taylor Farms itself; and Subway.

Subway is 8,075 cases of quarter-inch shredded lettuce across fourteen lot codes. It is the largest single restaurant chain in this recall — larger than Yum at 5,900 cases, larger than Jack in the Box at 5,130. Subway has said nothing about this outbreak in three weeks. Jack in the Box put its own name out on July 18 without being made to and told reporters which states had received the product. The chain that volunteered is the one everybody has heard about. The chain that stayed quiet is the one nobody has written about, and it is the bigger of the two. That is not a coincidence. 

The Yum (Taco Bell) entry is 5,900 cases of quarter-inch shredded iceberg, and it has four lot codes. Four. They come from two days of production, Wednesday July 8 and Saturday July 11. The use-by dates run fourteen days past production, the shortest spec in the recall, and the earliest of them is July 22 — the latest starting point in the entire file. Whatever went to Yum under this recall was cut no earlier than July 8.

CDC’s median illness onset in this outbreak is June 22, and Cyclospora takes about a week to make somebody sick after they eat it. The median patient was exposed in the middle of June, and the first patients well before that. The customer sitting closest to the exposure that defines this outbreak had the narrowest recall of anyone in the file: two days of lettuce, weeks after people were already in the hospital.

There is a reason for that, and it is arithmetic rather than epidemiology. Every recalled item carries a use-by date, and not one of the 236,192 cases has a use-by date earlier than July 19 — two days after the recall was announced. Lettuce cut before the end of June had already expired by July 17. It had been eaten. You cannot recall it. The front edge of this recall is not a finding about when contamination started. It is the recall date minus the shelf life.

Doctor Mora did not open its doors in late June 2026. It is the same plant at the center of a Cyclospora outbreak in 2013, which means it has been shipping into this country for at least thirteen years. I said on July 19 that this recall could not have reached the lettuce that made the first thousands of people sick. I did not know then that FDA’s own file would prove it.

The next thing in the file is that this was never only an iceberg recall. FDA annotates every entry with what is actually in the product. Iceberg alone accounts for 167,504 cases. The remaining 68,688 — twenty-nine percent — is something more: lettuce and romaine blends at fifty-fifty, seventy-thirty and eighty-twenty; garden salad mixes with carrots and red cabbage; and salads carrying all four. Romaine, carrots and red cabbage came out of Doctor Mora and went into this recall, and the FDA outbreak page, the CDC outbreak page and every news story I have read say iceberg.

The company’s answer deserves to be stated fairly and stated first. Taylor Farms says on its Cyclospora information hub that the recall is limited to iceberg grown and processed at its central Mexico facility, and that its retail branded salad kits and chopped kits are unaffected. Those blends and mixes are foodservice packs — four five-pound bags to a case, six five-pound bags to a case — so the retail sentence holds as written. What separates a recalled Taylor Farms garden salad mix from a retail salad kit is pack size and sales channel, not what is inside the bag.

The lot codes show something the product names do not. Take TFMX191A02, one production run on Friday, July 10. It appears in thirteen of the twenty-one entries in this recall. It went out as plain shredded iceberg, as a lettuce and romaine blend, as a carrot and red cabbage salad mix, and as a four-vegetable salad with separate baggies — to Cross Valley Farms, Markon, Peak, Sysco and Taylor Farms’ own label, carrying four different use-by dates depending on the buyer. It is not the only one. Nine separate lot codes in this recall span all four product types.

I want to be careful about what that does and does not prove. The code almost certainly tracks the iceberg, with the romaine and the carrots and the cabbage blended in from somewhere else, so this is not evidence that the romaine was contaminated. It is evidence that one run of iceberg from Doctor Mora ended up in four different kinds of bag under five different companies’ names — and that when people were told to check their refrigerators for iceberg lettuce, some of them were holding a garden salad.

Then the volume, which has not been public in any form until now. Marketside — Walmart — is 109,476 cases, nearly half the recall by itself and the only entry aimed at consumers rather than restaurants. Four items, roughly ninety lot codes, ten to twelve bags to a case. That is well over a million bags of lettuce sold to Walmart shoppers. Taylor Farms’ own label is 68,897 cases. Cross Valley Farms is 19,016. Sysco is 11,519, Subway 8,075, Markon 7,459, Yum 5,900, Jack in the Box 5,130 and Peak 720.

Markon deserves its own sentence for a different reason. It is not a restaurant. It is a foodservice purchasing cooperative whose member distributors resell to independent operators who never see the Markon name on anything. A recall notice that reaches Markon has not yet reached the kitchen holding the lettuce. It is two more steps away, and nothing in the public record tells you whether it ever arrived.

Two more things sit in the distribution field, and I cannot explain either one. FDA’s recall record lists twenty-seven states, and West Virginia is not among them — while FDA’s own outbreak page lists West Virginia as an outbreak state, one of the original five. Same agency, same recall, two answers.

And at the end of the field, one line: foreign distribution, Mexico. The recalled lettuce went into the Mexican domestic market as well as the American one. I cannot find a Mexican recall notice anywhere. That does not mean there is not one. It means I cannot find it, and so far as I can tell nobody has asked.

Three weeks in, all twenty-one entries still read “Not Yet Classified.” No recall number assigned. No classification date. Status: ongoing. That matters more than it sounds, because the weekly Enforcement Report — the place FDA tells the public and the trade to look for recalls — only publishes a recall once the agency has classified it by hazard.

There is one field I do not understand at all. Every row carries a report date of August 19, 2026 — eleven days from now — while the classification is still blank and the recall number is still empty. I do not know what that means.

What do we now need from the FDA? 

  • Classify the recall, so that it appears where the public and the trade are told to look.
  • Publish the customer names with the notice, not in a database you have to already know exists in order to search.
  • Reconcile the state lists. 
  • Say what happened to the product that stayed in Mexico.
  • Produce the import history for the Doctor Mora plant, because that record will show how much, if any, lettuce crossed the border in May and June — the lettuce that is not in this recall, and that the sick people likely already ate.

Every number above comes out of FDA’s own enforcement record for Event 99453, and every link is here so you can check my work. The national case counts and the outbreak reporting are worth reading alongside it.

Check my work:

https://www.marlerblog.com/files/2026/08/08-08-2026_enforce_rpt.pdf

I was awake at three o’clock this morning doing arithmetic I did not want to do.  I have been thinking about this for weeks and considering the numbers.

Three outbreaks have shaped thirty-three years of my life. In the winter of 1993, undercooked hamburger from Jack in the Box carried E. coli O157:H7 into 732 people across four states. One hundred seventy-one of them were hospitalized. One hundred seventy-eight were left with permanent injury, most of it kidney and brain damage. Four children died, the youngest seventeen months old. In 2008 and 2009, peanut paste from a plant in Blakely, Georgia carried Salmonella Typhimurium out of Peanut Corporation of America and into 714 people in forty-six states. More than half of them were children and a fifth were under the age of five. Nine died. In 2011, cantaloupe from Jensen Farms carried Listeria monocytogenes into 147 people in twenty-eight states. One hundred forty-three of those 147 were hospitalized, ninety-nine percent of everyone who got sick. Thirty-three died and one pregnant woman lost her baby. The median age was seventy-eight. I represented the families of all thirty-three of the dead.

Put those three outbreaks end to end and they sickened 1,593 Americans and filled forty-six graves. The Cyclospora outbreak running right now has sickened at least 26,755 people. That is nearly seventeen times the three defining outbreaks of my career combined, and it has killed two.

There is a way to say that sentence that insults twenty-six thousand people, and I do not mean it that way. Let me deal with that first, because it matters more to me than the arithmetic does.

Nobody who has had cyclosporiasis has ever described it to me as mild. It starts about a week after exposure, sometimes as early as two days and sometimes as late as two weeks. Then comes watery, explosive diarrhea six to ten times a day, cramping, bloating, gas, nausea, a complete loss of appetite, and a fatigue that outlasts all of it. People lose ten, fifteen, twenty pounds. The worst part is that it comes back. It remits and relapses for days and sometimes for more than a month. People go back to work feeling human and are flattened again the following week. The only reliable treatment is trimethoprim-sulfamethoxazole, so a sulfa allergy leaves a patient with very little. There is no protective immunity afterward, which means a person can get it again. Three decades of listening to people describe foodborne illness, and this one is genuinely awful.

Two people in Michigan have died. Both, according to the state health department, had significant underlying conditions that may have been affected by cyclosporiasis and dehydration, and both became ill before the July 17 recall. I am not going to say more about them than that. Two families are living with this, and the fact that a statistician would call the case fatality rate low is of no use to either of them.

What kept me awake was not the two. It was what the number would have been if the organism riding on that lettuce had been one of the other three. CDC publishes the tool for answering that. Its burden model records, for each pathogen, the share of laboratory-confirmed patients who are hospitalized and the share who die. Checked against this outbreak first, the Cyclospora rate predicts about 1,739 hospitalizations out of 26,755 reported cases, and the thirteen states that publish a figure have reported 680 on a count that is still climbing. Here is what the same 26,755 people would have produced under each of the four organisms.

OrganismHospitalizedRateDeathsMultiplier
Cyclospora1,7396.5%083.1
Salmonella, nontyphoidal7,27727.2%13429.3
E. coli O157:H712,36146.2%13426.1
Listeria monocytogenes25,15094.0%4,2542.1

The model says the Cyclospora row should show zero deaths. It shows two. On the one organism where CDC’s model can be checked against reality this summer, it understates.

I do not have to take the model on faith for the other three, because I watched all of them. Jack in the Box hospitalized 171 of 732 and killed four. Run those observed rates against 26,755 and you get roughly 6,250 people in hospital beds and 146 dead. CDC’s model, built from entirely different data thirty years later, says 134. My own cases and the federal model land in the same place. That convergence is the part I could not put down.

The Listeria row in that table is not a real number and saying why is the most important thing in this piece. Twenty-six thousand seven hundred fifty-five invasive listeriosis cases would be roughly twenty-one years of the entire American burden of that disease compressed into one summer. It cannot happen, because Listeriakills people long before a count climbs that high. The largest listeriosis outbreak in American history was 147 people, and it killed thirty-three of them. The deadliest was 142 people in Los Angeles in 1985, and it killed forty-eight, twenty of them unborn. Neither one reached a hundred and fifty. Hold that against 26,755 and two.

That contrast is not a curiosity. It is the whole argument, and it is sitting in the last column of the table.

The last column is the underdiagnosis multiplier, CDC’s estimate of how many people actually get sick for everyone who is diagnosed and counted. Listeria is 2.1 in the older model and 1.7 in the 2025 rebuild. Cyclospora is 83.1. Listeria is 1.7 because it nearly always puts a person in a hospital where somebody draws a blood culture. Cyclospora is 83.1 because it sends a person home for a month. The multiplier is a severity index wearing a disguise, and this summer’s enormous count is enormous precisely because the organism is survivable. A lethal one would have produced a far smaller number that was far more complete. The size of the count and the mildness of the disease are the same fact.

The table also does not show what happens to the survivors. Five to ten percent of E. coli O157:H7 patients develop hemolytic uremic syndrome, which at 26,755 cases is between 1,338 and 2,676 people, most of them children. About half of them need dialysis, three to five percent die, and ten to thirty percent of the survivorscarry long-term kidney damage.

Now hold the exposure constant instead of the case count, which is the honest way to run this. Same field in central Mexico, same untested irrigation water, same processing plant at Doctor Mora, same 1.1 million bags of lettuce into a national grocery chain, same twenty-seven-state distribution footprint in FDA’s own recall record, same recall with its window set by shelf life rather than by contamination, reaching back only to product made in the last days of June against a median illness onset of June 22. Nothing in that chain is Cyclospora-specific. The water was not tested for anything. There is no kill step on a bag of lettuce for any organism and washing defeats none of them. The traceability rule that would have shortened the traceback is delayed to July 2028 for all of them, by Congressional direction. The agricultural water rule names generic E. coli as its only numeric criterion. Every one of those failures sits in exactly the same place if what was living in that canal had been O157 instead. And O157 does not send people home for a month. It sends children to dialysis, and in some instances, early deaths.

I do not have to imagine that one either. In 2006, E. coli O157:H7 came out of river water on a California ranch where a grass-fed cattle operation sat less than a mile from the spinach field, and it went into bags of fresh spinach shipped across the country. Two hundred twenty-five people were counted in twenty-seven states. One hundred sixteen of them were hospitalized. Thirty-nine developed hemolytic uremic syndrome. Five died. I litigated that one too. That is the same commodity, the same absence of a kill step, and the same water nobody was testing, twenty years earlier and with a different organism in it.

Here is the bleakest thing I know about my own profession. Every reform I have watched this country make came after a body count. Four dead children in 1993 got us pathogen reduction, hazard analysis, and E. coliO157:H7 declared an adulterant in ground beef. Five dead from spinach and nine dead from peanut butter got us the Food Safety Modernization Act and, eventually, a company president sentenced to twenty-eight years. Thirty-three dead from cantaloupe, seven months after that law was signed, put two growers in federal criminal court. Nobody legislated because 732 people had bloody diarrhea or because 147 people were hospitalized. They legislated because of the graves.

That means the arithmetic cuts the wrong way this time. This outbreak has produced more sick Americans than the three defining outbreaks of my career put together, and it has produced two deaths, and two deaths is not enough to move anybody.

I should say plainly what this exercise is and is not. Pathogens cannot simply be swapped at a constant case count, because attack rates and who gets sick differ by organism, and this summer’s 26,755 exists partly because Cyclospora leaves a large population alive to be counted. The rates I applied are observed among laboratory-confirmed patients while the 26,755 includes probable cases, so the run is generous. None of that changes the direction, and the direction is the only thing I am claiming.

We did not manage this outbreak. We drew the mild card. Twenty-six thousand seven hundred fifty-five people, at least 680 hospital beds and two graves is what the failure of an entire food safety system looks like when the organism happens to be the gentlest one in the deck. The national case count is still climbing. The next contaminated field will be planted in a few months, and nobody gets to choose what bug is living in the water when it is.

Luck is not a food safety program.