In November 2013, after Cyclospora cayetanensis sickened hundreds of people in Iowa and Nebraska, FDA published an environmental assessment of the Taylor Farms de México processing plant at Doctor Mora, Guanajuato. The report closed with recommendations. The second told the firm to determine whether Cyclospora is a reasonably likely hazard in the Guanajuato leafy green growing region and, if it is, to re-evaluate the wash step used on salad mix. Thirteen years later the same region sits at the center of the largest cyclosporiasis outbreak in American history, and no one has produced a document showing that determination was ever made.

Here is what a hazard analysis would have found, had anyone performed one. Two hundred and thirty-five meters from the processing building — roughly eight hundred feet, a three-minute walk — sits Balneario Las Fajanas, a public thermal-water bathing complex with pools, water slides, changing rooms, showers, grills and picnic shelters, open every day of the year. It is the largest concentration of human fecal loading anywhere near that plant. And satellite imagery establishes that it was already built, filled and operating in March 2010, more than three years before FDA and COFEPRIS ever set foot on the property.

March 4, 2010. Taylor Farms de México at center; Balneario Las Fajanas at lower right, pools filled, buildings and mature tree cover in place. More than three years before the FDA and COFEPRIS assessment. Google Earth historical imagery.

That image forecloses the only innocent explanation. Nobody can now say the balneario came later, or that the environment changed after the inspectors left. When FDA and COFEPRIS walked that site in August 2013, a public bathing facility with filled pools stood across the highway in plain view and had stood there for years. The published assessment describes the processing plant and five ranches. It does not describe a bathing complex. 

It is worth setting out what is actually on that property, because the detail matters. The Guanajuato Secretariat of Tourism lists Las Fajanas in its official state guide under balnearios and water parks, at Km 16 of the San Miguel de Allende–Doctor Mora highway, locality of Cruz de la Maza, with state-published coordinates of 21.10266, -100.45159. The state describes thermal-water pools, extensive lawns, parking, water slides, palapas, grills, restrooms, showers, changing rooms and a snack shop, and flags the site as accessible. Other listings add a soda fountain, a store, sports courts and a bar. The operator advertises thermal water held at 40 degrees Celsius and promotes that the facility is open 365 days a year. Admission has climbed steadily — 80 pesos for adults and 40 for children in earlier listings, 100 and 40 after that, 120 and 60 from the first of February, and 150 adults and 80 children from the twenty-third of March. Prices rise like that when demand supports it. The Google listing carries 897 reviews. There is no website; the business runs on Facebook.

Water slides produce high water ingestion, particularly among children. Grills and picnic shelters mean families stay all day rather than an hour, which multiplies restroom use per visitor. Thermal water at 40 degrees means the facility is drawing from a deep geothermal source and moving large volumes of it — and every liter that goes into a pool eventually comes out of one. Where it goes when it leaves is the entire question, and no public listing answers it.

June 14, 2023. The same frame. The balneario is largely unchanged. The Taylor Farms facility is not — note the enlarged processing building, the solar array at left, the formal employee parking, and the trailer yard across the top of the image. Google Earth historical imagery.

Put the two frames side by side and a second argument appears, one that has nothing to do with the balneario. The bathing complex in 2023 looks much as it did in 2010. The Taylor Farms facility does not. The 2010 image shows a moderate plant: one main building, blue-roofed outbuildings, a large unpaved graded area to the north. The 2023 image shows a substantially larger processing building, a solar array along the western boundary, hundreds of employee vehicles in formal parking rows, and a trailer yard holding well over a hundred units. That is not incremental growth. That is a different scale of operation — more throughput, more wash water, more workers, more waste.

One more feature is visible in both frames and deserves attention from someone qualified to identify it. A linear channel runs east to west immediately north of the highway, between the plant and the balneario, and appears to hold water in both images. The 2023 frame also shows a standing water body along that channel southwest of the plant. If that is an irrigation canal or a drainage ditch, it is a surface pathway between the two properties — and surface connection is far easier to establish than aquifer connection. It would also have been visible from the plant yard in 2013. Separately, the 2010 frame shows a dark oval pond immediately southwest of the main building that I cannot find in the 2023 frame. If that was a retention or process-water lagoon, its disappearance during the expansion is a records question worth asking.

Cyclospora cayetanensis has no animal reservoir. Cattle do not carry it, wildlife does not carry it, birds do not carry it. It completes its life cycle in human beings and nowhere else. Every oocyst that ends up on a leaf of iceberg lettuce came out of a person. With E. coli O157:H7 you go looking for a feedlot upgradient of the field. With Cyclospora you go looking for human sewage.

Cyclospora Oocysts are shed unsporulated and non-infectious. They must sit in the environment for roughly one to two weeks at temperatures between about 22 and 32 degrees Celsius before they can infect anyone, which is why CDC says direct person-to-person transmission is unlikely. A sick person cannot hand this parasite to the person beside them. What that person can do is deposit inert oocysts into soil or water, walk away, and leave them to ripen. And northeastern Guanajuato is close to ideal for that ripening: mean daily maximum temperatures at San José Iturbide run from about 23 to 31 degrees Celsius across the entire year, sitting inside the sporulation window in every month.

I want to be careful here, because there is a version of this argument that is wrong. On July 15 the International Fresh Produce Association faulted Michigan’s health department for saying recreational water is not a recognized risk factor, cited three papers for the proposition, and told The Packer that Michigan was defying reputable science. Its consumer FAQ still tells readers that pool chlorine will not kill Cyclospora and that people who swallow pool water are not protected the way they would be from other waterborne illnesses. County health departments in Ohio and Arizona have said much the same thing. The implication running through all of it is that swimmers are catching this. They are not.

The most recent global review of waterborne protozoan outbreaks, published by Bourli and colleagues in the Journal of Water and Health in 2023 and the fifth in a series running since 2007, catalogued 416 outbreaks worldwide between 2017 and 2022. Recreational water and swimming pools were the suspected source in 313 of them — three quarters of the total — and 92 percent of those were Cryptosporidium. Cyclospora caused three outbreaks in the entire six-year window, and the review lists each one by name: drinking water in Poland traced to travelers from Indonesia, drinking water in South Korea traced to travelers who drank at a church in Nepal, and a British cluster among travelers returning from Mexico whose recorded exposures were fruit, salad vegetables, fresh herbs, bottled water and ice. Not one of them is a pool. Cryptosporidium owns that category, because Cryptosporidium is infectious the moment it leaves the body. Cyclospora is not. A health department urging caution about pools is being careful. A trade association telling you recreational water is a live risk factor in this outbreak is doing something else. It is moving the story off lettuce.

The defensible argument is not that the balneario infected swimmers. It is that the balneario is a fecal loading point into the environmental water system surrounding a ready-to-eat produce plant. And that mechanism is not my invention. It is the express premise of the research the produce industry has been funding for a decade.

The Center for Produce Safety states plainly that it has invested 1.6 million dollars in Cyclospora research since 2014, and that the results confirmed the parasite is endemic in the United States and can be recovered from wastewater and irrigation water, which it calls a significant risk for produce contamination. That is the industry’s own research arm saying the parasite lives in sewage and reaches crops through water. Go one level down and the mechanism gets named outright: a CPS and USDA-listed project led by Charles Gerba, Kelly Bright, Paula Rivadeneira and Walter Betancourt at Arizona was built to determine whether American produce is at risk from irrigation water contaminated by human sewage, and it specifies the sources — faulty and leaking septic systems, compromised sewer pipes, and treated wastewater effluent discharged into surface waters used to irrigate food crops. The USDA National Agricultural Library listing carries the identical framing. Faulty septic near produce ground is not a theory I am floating. It is a funded federal research question.

The surveillance results tell you where the parasite actually is. A two-year study in a Southeastern Georgia growing region, published in the Journal of Food Protection and funded through CPS, sampled municipal wastewater sludge, on-farm portable toilets, irrigation pond water and spent packinghouse dump tank water. The parasite lives in human sewage, reliably. And an unconfirmed molecular positive on agricultural water is a known published artifact — precisely what happened at the border in July, and why that false positive proved nothing about whether the lettuce was contaminated.

Treatment does not solve it. Kitajima, Haramoto, Iker and Gerba sampled two Arizona wastewater treatment plantsmonthly for a year, detected Cyclospora in wastewater with a purpose-built assay, and concluded that conventional treatment is limited in its ability to remove protozoan oocysts and cysts. That is a functioning municipal plant. A rural recreational facility is not going to do better. Nor is any of this new: Sterling and Ortega reported in Emerging Infectious Diseases that Cyclospora oocysts were recovered from sewage lagoons beside an endemic area of Lima, and that water from those lagoons irrigates pasture, corn, and elsewhere in the city, vegetable crops. That was 1999.

Straight-line distances computed from published coordinates. The processing plant is at 21.10634° N, 100.45266° W.

Taylor Farms will argue it cannot control what its neighbors put into the ground. That argument fails on the 2013 record. FDA told Taylor Farm, in writing, to determine whether Cyclospora is a reasonably likely hazard in this growing region, and if it is, to re-evaluate the wash step. A hazard analysis worth the paper it is printed on would have identified a public bathing complex eight hundred feet from the intake — a bathing complex that the satellite record now proves was sitting there, pools filled, three years before the inspectors arrived. The failure here is not that the balneario is there. The failure is that the federal government said look, and thirteen years and one record-breaking outbreak later, no one can show that anybody did.

Mexico’s health secretary, David Kershenobich, told reporters Tuesday that his government has found no evidence that the outbreak sickening thousands of Americans began on a lettuce farm in Guanajuato. He said Mexico is taking precautions anyway, and its food-safety agencies, Cofepris and Senasica, say they are running preventive inspections and traceability checks in the state. It is a careful statement, and a defensible one on its own terms. It is also the newest verse in a song that has played for two weeks: Taylor Farms says it was less than one percent of the iceberg supply, the produce trade groups say the case rests on interviews, and now a national government says no laboratory result points its way. Every one of them is standing on the same fact — that no sample of the lettuce has tested positive for the parasite. For this parasite, that fact means almost nothing.

Here is why. Cyclospora cannot be grown in a laboratory — there is no culture, no animal model, no way to multiply it and confirm it the way a lab confirms Salmonella or E. coli. Detecting it means finding its DNA on the produce itself, and the produce is lettuce: it is eaten or thrown away within days, while the people who ate it do not fall sick for a week and are not counted for a month or more. By the time investigators know an outbreak exists, the lots that caused it are gone. Contamination is patchy, too — a clean twenty-five-gram sample says nothing about the leaf beside it. So, a negative test is not evidence of a safe field. It is evidence that the evidence was eaten. The one positive sample the FDA did announce, from Taylor Farms de Mexico lettuce, it retracted two days later as a false positive. The absence that remains is not exoneration. It is the ordinary condition of a Cyclospora investigation.

What investigators have instead is the thing that actually breaks these outbreaks open: sick people and a supply chain. Sixteen hundred and forty-four of them. That is how many people across five states — Indiana, Kentucky, Michigan, Ohio and West Virginia — caught Cyclospora after eating at Taco Bell, with illnesses starting between May 13 and July 13 and ninety-four of them hospitalized. Sixteen hundred strangers in five states do not share a rare parasite by coincidence. They shared a restaurant. Michigan interviewed one hundred ninety of its Taco Bell patients, and ninety percent had eaten the iceberg lettuce; the FDA then traced that lettuce back through the chain, and it converged on one supplier — Taylor Farms de Mexico, in central Mexico. That is the evidence, and it is the part the minister’s statement steps around. A positive lab sample would be welcome, but it is not required and never has been. As NBC noted this week, a positive test is not necessarily needed to name a source. What names it here is 1,644 people and one farm at the end of every thread.

And 2013 is the part the statement left out. The same Guanajuato facility — Taylor Farms de Mexico — was the source of a Cyclospora outbreak that sickened more than six hundred people across twenty-five states, traced to salad mix served at Olive Garden and Red Lobster. There was a no-evidence-yet posture then, too, and stepped-up border screening, and a company that pulled far more product than the implicated lot. No one wanted to be the answer. Eleven years later the answer was the same place.

The count is not waiting for anyone’s certainty. CDC now reports 4,173 laboratory-confirmed domestic cases since May 1 and says it is aware of more than 7,400 additional cases not yet confirmed — many of them in Michigan and Ohio — for a national total above eleven thousand five hundred across forty-one states, with three hundred and eight people hospitalized. Michigan alone reported 7,171 cases on Wednesday, up six hundred in a single day. The states themselves add up to a little more; below is where each one stands tonight, with the source for every number.

A word on the counts. Where a state publishes its own figure I used it, because state health departments are closer to the illnesses and update more often; where CDC’s own state table differs materially, I noted both. Update cadence is uneven — Michigan and Indiana post daily on weekdays, West Virginia Tuesdays and Fridays, Ohio and Kentucky weekly — so any national total is a blend of numbers of different ages, and sixteen states publish no 2026 count at all. The roughly 11,350 these fifty numbers add to is a floor, not a ceiling.

So, Mexico is right that there is no laboratory evidence its lettuce made anyone sick. It is right the way a supplier is right when it points to a clean test, and the way a trade group is right when it says the case rests on interviews. In a Cyclospora outbreak the laboratory almost never arrives in time, and everyone who has worked one of these knows it. The evidence here is sixteen hundred people who ate at the same restaurant, thousands more who are sick, and a paper trail that keeps arriving at the same farm in Guanajuato — the same farm as 2013. I have been doing this since 1993, and I have never once watched a positive lettuce sample rescue anyone. The people are the evidence. They always were.

Nearly twelve thousand cyclosporiasis cases have now been reported to the CDC this summer — 4,173 confirmed in the laboratory as domestically acquired, and more than 7,400 more still awaiting the analysis that would confirm them, many of them in Michigan and Ohio. Michigan alone counted 6,571 as of July 21, with 102 hospitalizations and, so far, no deaths. Officials call it likely the largest outbreak of this parasite in the country’s history. As the count climbed, every corner of the produce and grocery world that speaks for itself put out a statement. Some of those statements have quietly changed since. Here is the whole map, group by group, with links so you can read each one yourself and check my work.

Start with the group that comes out of this best. The International Fresh Produce Association — the trade body that speaks for the whole supply chain — put out a sharp statement on July 15 through its chief science officer, Max Teplitski. Its core claim was that a survey of what sick people remembered eating, without a contaminated sample to match it, is a lead and not proof. I have spent thirty years arguing the other side of that in court, and I still think the epidemiology here is strong. But IFPA did something the others did not. When it softened the statement on July 19 — dropping the tougher lines about Michigan and about jobs — it left the original sitting right there on the same page, dated and signed, beneath the new version. You can read both at once. That is what a correction is supposed to look like.

Now the one that troubles me. The California and Arizona Leafy Greens Marketing Agreement, which speaks for the lettuce farms, also posted on July 15. That first version called lettuce a leading suspect, argued that Cyclospora has historically been tied to imported produce rather than domestic greens, and — to its credit — noted plainly that CDC had cut national Cyclospora surveillance in 2025 after federal budget reductions. That last point is mine too; it is the whole reason we cannot count this outbreak. The next day the page was replaced under a different byline with a warmer, more sympathetic message, and both of those lines were gone. The tone improved. But the original now survives only on the Wayback Machine. A statement you have to dig out of an internet archive is not a statement the public can still hold you to.

LGMA’s newest word came in a July 20 webinar with food-safety scientist Jennifer McEntire, formerly of IFPA. Her headline was blunt and, on the science, correct: “testing is not the answer.” Current methods for finding this parasite on a leaf are too unreliable to lean on. She is right that you cannot test your way to prevention. I would only add the other half of that truth: you cannot test your way to innocence either. When a supplier waves a clean sample, remember that a negative result on a parasite this hard to detect proves almost nothing — which is exactly why the people who ate the lettuce, not the lab, are the evidence in an outbreak like this.

FMI, the grocery-industry association, wrote the clearest consumer material of anyone. It confirms the recall, links the federal notices, and states the gap between confirmed and probable cases honestly. I will praise it without hedging — and then note the thing that sits awkwardly beside the praise. FMI has been the most forceful voice in the country for delaying the food traceability rule that would make outbreaks like this traceable in the first place. Both things are true at once, and readers deserve to know both.

The National Grocers Association broke a longer silence with practical guidance for independent stores. It is useful, with one real problem: it tells grocers to reassure customers that there is no broad retail recall. There is one. The recall reached bagged Marketside iceberg and shredded lettuce on Walmart shelves in more than a dozen states, and federal officials are telling shoppers to throw it out. NGA also applauded the thirty-month delay of the traceability rule as too hard on smaller grocers. I understand the burden; I would ask them to weigh it against the count in Michigan.

Give Western Growers credit for the most serious piece of thinking from inside the industry. Joelle Mosso named three gaps — risk communication, national surveillance, and the way the country handles imported risk. I wrote back to say she is right on two of the three. On surveillance and on imports she is closer to the mark than most of the public-health commentary I have read this month. Where we part is her call for quieter, more careful warnings; the cure for a vague warning is a faster, more specific one, and that requires traceability, not restraint.

And then the silences. The National Restaurant Association has said nothing about an outbreak that ran through a fast-food chain, even as reporters asked. The Fresh Produce Association of the Americas, which speaks for importers of exactly this kind of Mexican produce, has said nothing either. The silence is more glaring because Taco Bell — an operator, not a trade group, and the one with the most to lose from talking — pulled the lettuce and said so twice, ahead of the federal advisory. When the restaurant on the corner outruns the associations built to speak for the industry, the associations should notice.

So far this is a story about the groups that speak for the industry. But the company at the center of the outbreak has been speaking for itself, too — and it has done the quiet-edit trick more brazenly than any association here. The credit for catching it belongs to Bloomberg’s Jessica Nix and Kristina Peterson, who on July 21 lined up the dates and called what they found a slow-walk. The recall window ran June 29 to July 16 — weeks after the first illnesses began in mid-May. By the time Taylor Farms’ lettuce came off the shelf, the contaminated product had already been eaten.

Watch the statement itself. Taylor Farms’ first version, on July 17, opened with concern for the sick and — this is the sentence that matters — acknowledged that FDA’s traceback pointed to a specific central-Mexico farm, which it called less than one percent of the U.S. iceberg supply, and said it had pulled all of the region’s iceberg. Over the next forty-eight hours the company rewrote that statement at the same web address, with no version note. The sympathy slid from the first paragraph to the fourth. A grievance against FDA rose to the lead. And the acknowledgment that the traceback pointed at its own farm simply vanished. It is the same edit-in-the-dark I faulted LGMA for above, performed by the company with the most to lose.

That vanished sentence may be the most important one in the whole outbreak, and here is why. Taylor Farms wrote it on July 17 — before any product sample was ever reported positive. It is the company’s own admission, in its own words, that the recall rested on FDA’s traceback and the epidemiology, not on a lab result. Which is why the false positive the company spent the following Sunday turning into a demand for an apology changes nothing. In a Cyclospora outbreak the victims ate the evidence months ago; a clean sample proves nothing, and Taylor Farms had already conceded as much in writing before the sample existed.

And none of it happened in a vacuum. The New York Times reported, and a Taylor Farms spokeswoman confirmed, that on July 16 — the day before the recall — company executives met with White House and FDA officials to complain about what they called shortfalls in the agencies’ outbreak response, challenged the finding that their lettuce was responsible, and worked to distance the company from the illnesses — while conceding they had only been contacted in the days just before the recall, after investigators had been chasing this outbreak for weeks. The Times also reported the company had been staffing up in Washington, hiring a former Trump White House personnel official. Then, on July 20, FDA answered in public: the false positive does not change the overwhelming epidemiological data, and the traceback continues to converge on Taylor Farms locations — plural — in central Mexico, not the single small farm the company had named on July 17 and unnamed by July 19.

Step back, and every one of these statements is circling the same hole. No one — not the growers, not the grocers, not the agencies — can catch a contaminated leaf before it ships, count the people it sickens, or trace it back to the field fast enough to matter. That is not bad luck. Over the last fifteen years this country took apart the three tools built to do exactly those things, one after another, and this outbreak walked straight through the space where they used to be.

Start with the one almost no one remembers. For a decade the U.S. Department of Agriculture ran the Microbiological Data Program — the MDP — which did the single thing none of the systems above can do now: it went out and tested the produce itself. From 2001 to 2012, on a budget of about five million dollars a year, it pulled more than 120,000 samples of high-risk fruits and vegetables off shelves across 42 states, screened them for pathogens, and when it found one it told FDA, CDC and the states right away. In 2010 and 2011 alone its findings drove twenty-three produce recalls, fifteen of them tied to real human illness. It was, in plain terms, the country’s early-warning radar for contaminated produce — the one program that looked at the lettuce instead of waiting for the patients.

Then it was gone. The program was zeroed out in the Obama administration’s 2013 budget, defended by USDA as work that fell outside its marketing agency’s mission, over the objection of Congresswoman Rosa DeLauro. And Food Safety News reported at the time that the produce industry’s own paid lobbyists had pushed to end it — the trade group leading that effort was United Fresh, which in 2022 merged into the International Fresh Produce Association. The same house that helped switch off the radar is the one now, in this outbreak, calling for surveillance to be rebuilt. I do not raise that to score a point. I raise it because IFPA is right that we need it back, and it is better positioned than anyone to help undo what its predecessor helped do. Bring the MDP back, or something like it, and someone is once again testing the produce before it reaches a taco.

The second tool went dark just last year, and it is the reason you keep seeing two different numbers for this outbreak. On July 1, 2025, the CDC cut its foodborne-illness surveillance network, FoodNet, from eight pathogens down to two — it kept Salmonella and E. coli and made Cyclospora, along with Campylobacter, Listeria and three others, optional to report. The agency’s own explanation was money: the funding had not kept up. That is why Michigan alone now counts more cases than the CDC has laboratory-confirmed in the entire country, and why the states’ tallies and the federal one keep telling two different stories. We are living through an outbreak the national system is no longer built to count. And here let me be just as fair in the other direction: you cannot lay FoodNet at the produce industry’s feet. No lobbyist killed it. It was a budget decision at CDC, made under a different administration than the one that ended the MDP — which is exactly the point. Across fifteen years and both parties, foodborne-disease surveillance has been treated as the easy thing to cut. Fixing FoodNet — restoring the full list of pathogens and the money underneath it — is the fastest way to at least see clearly the outbreak we are already in.

The third tool is the one still salvageable, because it wasn’t killed — only shelved. FSMA Section 204, the Food Traceability Rule, puts leafy greens on a list and requires lot-level records a company must hand over electronically within twenty-four hours. It was supposed to take effect this past January. It now sits with a 2028 date on it, pushed there with the produce and grocery industry’s blessing.

The sharpest proof of what that last rule would buy came from IFPA’s own scientist. Asked by The Packer on July 15 how full traceability would have changed this outbreak, Teplitski reached for the cilantro that investigators had wrongly floated before the Fourth of July. With the rule in force, he said, you could establish in an afternoon whether a given lot of cilantro went into a given salsa, which kitchen received it, when, and where else it traveled — then line that up against the map of who got sick and rule cilantro out fast.

The rule, he said, “would’ve helped to eliminate cilantro as a suspect within hours.”

Read that again, because it is the whole argument in one sentence. Teplitski wants the traceability rule so the industry can clear an innocent product in hours. I want the same rule so investigators can name a guilty one in hours. It is the same twenty-four-hour records requirement doing both jobs — and his industry lobbied to delay it to 2028. On the science of this parasite, IFPA has been the most honest voice in the room. The next honest thing it could do is spend its considerable weight in Washington getting the one rule that would end the guessing put back on the calendar. I would stand with them if they did.

Catch it, count it, trace it. The Microbiological Data Program could have caught this lettuce. FoodNet could have counted the sick. The Traceability Rule could have found the field. We dismantled the first, defunded the second, and delayed the third — and then acted surprised at an outbreak from a source no one can name. Two of those three failures the produce industry had a hand in. The honest response now is not to relitigate the blame but to put all three tools back, and the industry groups in the table above are the ones with the weight in Washington to do it.

Until then, the count in Michigan climbs by the hundreds each morning, the source of most of those cases is still officially unnamed, and the industry’s statements about it are, in a couple of cases, no longer the statements it first wrote. I have tried to keep this record straight and fair, and to hold myself to the same standard I am asking of everyone else: when the facts move, you correct in the open and you leave the original where people can find it.

The Secretary of Health and Human Services said today that this outbreak is “under control.” I would like that to be true. Here is what the states reported while he was saying it.

Michigan added 2,408 new cases in the week ending July 18. The three weeks before that were 71, then 498, then 1,331. That is not a curve bending down. That is a curve that has doubled in each of the last three weeks, and Michigan’s own total went from 6,148 on Monday to 6,571 today, with 23 more out-of-state cases waiting to be referred somewhere else. West Virginia went from 69 cases on July 13 to 195 today, with 15 hospitalized — nearly triple in eight days. CNN put it plainly this afternoon: the epidemiological curve has not yet slowed.

An outbreak is under control when new cases stop appearing. Not when a recall is issued. A recall is an action taken; control is a result observed. The Secretary described the first and called it the second.

There is a second problem with today’s statement. He said the source has been identified, citing extensive forensics. But FDA spent Sunday night withdrawing the only positive lettuce sample it had as a false positive. The traceback still points at Taylor Farms de Mexico, and FDA is right about that. But there is a difference between an epidemiological conclusion and a confirmed source, and the government is now claiming the second while holding the first. That is exactly the kind of overstatement that gets thrown back at investigators later.

He also said the criticism about surveillance cuts is invalid, and that FoodNet reductions were only for redundant surveillance. CDC made Cyclospora reporting optional in 2025. Six of the eight pathogens came off mandatory reporting. Whether you call that redundant depends on whether you ever intended to count this parasite. We are now two and a half months into a season in which nobody can say how many people are sick, and the Secretary’s own department publishes three different numbers.

Those numbers are worth laying out, because they are the heart of it. CDC’s outbreak investigation page says 1,644 people who reported eating at Taco Bell have been reported by five states, with 94 hospitalizations and illness onsets running from May 13 through July 13. CDC’s health advisory separately says 1,645 lab-confirmed domestically acquired cases across 34 states, with 141 hospitalizations. And CDC’s surveillance page says it is aware of more than 5,100 additional cases awaiting analysis, plus another 440 travel-associated cases. Meanwhile FDA’s outbreak table carries the iceberg lettuce cluster at 1,644 and four other open Cyclospora investigations alongside it.

Add up what the fifty states themselves are reporting and you get roughly 10,750. CDC concedes the point in its own words: it is aware that states are likely to report higher counts than its data reflects. The federal number is not wrong. It is just months behind, and it is the number the Secretary used to tell the country this is handled.

One more thing, and it is not a small one. Ohio’s health department reports 1,316 cases statewide as of July 16. The Toledo-Lucas County dashboard, covering only the northwest corner of that state, reports 2,029. A region inside Ohio is reporting more cases than Ohio. Both numbers are real; they come from different reporting systems that count different things on different days. That is the condition of American foodborne disease surveillance in the middle of the largest cyclosporiasis outbreak this country has ever had. Under control is not the phrase I would use.

Below is where all fifty states stand tonight, with the source for every number.

A word on the counts. Where a state publishes its own figure, I used it, because state health departments are closer to the illnesses and update more often. Where CDC’s own state table differs materially, I noted both — and it cuts in both directions. CDC lists more cases than the state does in New York, Colorado, California, Georgia and Virginia, and far fewer in Illinois. Nobody’s numbers agree with anybody’s.

Update cadence matters too, and it is uneven. Michigan and Indiana post daily on weekdays. West Virginia updates Tuesdays and Fridays. Ohio and Kentucky update weekly. CDC’s national figures have not moved since July 13. So any national total, including mine, is a blend of numbers of different ages. Sixteen states still publish no 2026 count at all.

Roughly 10,750 is a floor, not a ceiling. It mixes domestic and travel-associated illness in the states that do not separate them, it counts only people sick enough to see a doctor who ordered the specific test that finds this parasite, and it omits sixteen states entirely. CDC says the true number is likely higher. On that, the Secretary and I and CDC all agree.

On Sunday I graded every trade association in this outbreak on what it said and on how it handled being overtaken by events. I need to start by grading myself, because a paragraph of mine came apart within hours of publication. I wrote that there was a positive lot and that it was detained, and that we had gone from first naming a supplier to laboratory confirmation in seventy-two hours. That is not true. FDA has since concluded that the July 18 result on Taylor Farms de Mexico shredded iceberg does not represent true amplification and should be treated as a false positive. There has never been a confirmed positive product sample in this outbreak. I wrote about the retraction the same night, but I did not go back and fix the sentence, and that is on me.

It matters most because of who I used it against. I said Max Teplitski of the International Fresh Produce Association had claimed no contaminated product had been identified and that his claim was overtaken within two days. It was not overtaken. It is true today. He is entitled to hear me say so in the same place I said the opposite.

What has not changed is everything that was actually holding the case up. Michigan analyzed food-exposure details from 190 people who ate at Taco Bell and ninety percent of them ate iceberg lettuce. Traceback converged on a single supplier. FDA said on Sunday that the corrected laboratory result does not change the basis for the investigation or the overwhelming epidemiological data supporting the voluntary recall, and it went further on Monday, calling the epidemiology and traceback evidence very strong and saying that traceback and outbreak data continue to converge on shredded iceberg from Taylor Farms locations in central Mexico. An FDA official explained why the lab work is so thin and gave my own argument back to me better than I make it: with the time this takes and the epidemiology that has to happen first, the product may already have been eaten or thrown away, which turns testing into a chasing game. The word FDA is still using is implicated. The recall stands, and on Monday Taylor Farms said it will stop sourcing central Mexican iceberg for the rest of the growing season. As for the apology the company announced, an FDA official told Newsweek there was no official apology — the agency notified the company of the corrected result and explained how such a result can happen. However, my sentence about the positive sample was still wrong.

And Teplitski was half right about something else, which I should say now rather than after somebody makes me. His July 15 statement argued that patient recall explained at most about half the cases. FDA said Monday that of more than two thousand people interviewed — 2,025 of them in Michigan — many did not report eating lettuce at a chain restaurant, though lettuce showed up on the questionnaires again and again whether or not fast food did. He was right that the Taco Bell interviews do not explain everyone. But look at where that leads. It does not shrink this outbreak, it enlarges it. It means the five-state Taco Bell cluster is a subset of something bigger, that lettuce is showing up in the food histories of people who never went near a Taco Bell, and that the honest count is now above eight thousand across those five states with Michigan alone past six thousand one hundred. 

Now to the reason I am writing again. On Sunday evening at 8:15 p.m. Eastern, IFPA updated its statement. Same web address. But the new text sits above a horizontal rule and the entire July 15 original sits below it, each one separately dated and separately attributed to Teplitski. Nothing was deleted. Nothing was quietly rewritten. A reader arriving today can see exactly what the association said before, what it says now, and to the minute when it changed its mind.

Hold that against the rest of the week. LGMA took down the truest paragraph any trade group wrote about this outbreak and left no trace at the same URL, and as of this morning its page still says nothing about the retraction, or about anything else since July 16. Taylor Farms overwrote its own statement, moving sympathy for the sick from the first paragraph to the fourth and dropping its acknowledgment that FDA’s traceback pointed at a specific farm. FDA, by its own account, removed the sample information from its July 18 update rather than striking it through. Three parties edited the record. One party corrected it. The one that corrected it is the produce association whose founding board chair was the CEO of Taylor Farms. Credit where it is owed.

Here is what I missed the first time, buried in the last paragraph of the original that IFPA had the nerve to leave standing. IFPA writes that it has long been a champion of end-to-end traceability, that IFPA and its members are on the record against continued delays with the implementation of the Traceability Rule, and that it has offered technological solutions that would bring the entire supply chain into compliance. On Sunday I wrote that I could find no evidence IFPA lobbied for the delay. That was an understatement. The largest produce trade association in the country is on the record against the delay, in writing, twice, during the outbreak, while the rule it wants is sitting on a shelf.

So let me take them at their word.Today is July 20, 2026. Congress set July 20, 2028 as the date before which FDA may not enforce the Food Traceability Rule. Two years, to the day. FSMA 204 requires lot-level records producible in twenty-four hours, and leafy greens are on the list, and compliance was supposed to begin this past January. Instead, FDA published a recall notice in the middle of the largest Cyclospora outbreak in American history with no lot codes and customers identified only as CV, JB, MARK, MKTSD, PK, SUB, SY and TF. IFPA’s own consumer FAQ explains why that is intolerable better than I can: one bag of salad can combine lettuce from several growers in different states or countries, washed and packed at a single facility, and once commingled there is no way to tell whose product is in the bag.

IFPA has a government relations shop, a lobbying budget north of a million dollars a year, and a political action committee. I have a blog that no one reads. IFPA can move that date and I cannot. Ask Congress to repeal the non-enforcement rider and put the January 2026 compliance date back where it was, and say so with the same specificity you used when you told Michigan its epidemiology was not robust enough.

One association that was silent on Sunday is not silent now. The National Grocers Association has published guidance for independent grocers, and it is current through the retraction, plainly written, and useful — it tells retailers what the parasite is, what FDA has and has not confirmed, and to stay in contact with their suppliers. That is more than most produced this month and I am glad to see it.

But there is a sentence in it that has to be fixed today. NGA tells its members to reassure customers that there is currently no broad retail grocery recall associated with this investigation. That is not right. The Taylor Farms recall includesMarketside Iceberg Salad and Shredded Lettuce sold at Walmart across fifteen states with best-if-used-by dates running into August, and CDC is telling retailers and consumers to throw recalled lettuce out or take it back to the store. An independent grocer reading NGA’s page could reasonably conclude there is nothing on their shelf to check. There is. And I would note, without making more of it than it deserves, that NGA is one of the organizations that applauded the thirty-month delay of the traceability rule, arguing it fell hardest on smaller grocers. Smaller grocers are exactly the members who cannot afford to guess whether a recalled bag is in the cooler. Correct the sentence and then ask yourselves whether the rule you opposed is the one that would have answered the question for them.

And now the part I want people to watch for, because it started within a day. A radio station in Michigan — in the state with six thousand sick people — reported the retraction as good news: a routine supply-chain surveillance program, advanced sequencing confirming no active parasite, proof of the rigorous multi-tiered protocols that catch threats before they reach a plate, and relief for regional growers. Nearly every clause of that is wrong. The sample was not routine; it was taken because of this outbreak. Nothing was confirmed clean; a test was found unreliable and withdrawn, which is not the same thing. And no protocol caught anything before it reached a plate, because more than eight thousand people had already eaten. That is the story this becomes if nobody says otherwise, and by August it will be the version people remember.

The scorecard from Sunday needs a correction, a concession and an addition. The correction is mine: there is no positive product sample and there never was. The concession is that Teplitski was right about that and half right about the interviews, and the half he was right about should frighten all of us, because it means we cannot account for where the rest of this outbreak came from. The addition is NGA, which showed up late and got one sentence badly wrong, and IFPA, which published a new version and left the old one standing — more than the grower group, the supplier, or the government managed. There is now an offer on the table from a trade association that says it wants the same traceability rule I want. I am taking them up on it. 

Want to put me out of business? Move the date.

Taylor Fresh Foods told the public on Sunday that the FDA apologized to it – seemingly trying to sell the public that it has been exonerated as being the cause of some part of the Cyclospora Outbreak tearing through the East and Midwest. 

The company led with that sentence. On Monday morning FDA answered in its own voice, and the answer contains no apology. What it contains is this: the false-positive lab sample does not change the basis for the outbreak investigation, the epidemiological data supporting the Taylor Farms recall is overwhelming, traceback and outbreak data continue to converge on shredded iceberg lettuce from Taylor Farms locations in central Mexico, and the public should keep avoiding every product on the recall list. FDA also said it will keep working with federal and state partners to ensure products implicated in this outbreak have been removed from the market. 

So let us be precise about what actually happened, because there was only one test. A single sample of shredded lettuce from Taylor Farms de Mexico was pulled during import examination at the Southern Border, as part of the targeted surveillance FDA stood up because of this outbreak. It screened positive for Cyclospora. FDA notified the company. FDA’s own lab experts then re-reviewed the result, concluded the amplification was an artifact rather than a true detection, and notified the company again the same weekend. One sample, one correction, handled in about a day. I have no quarrel with any of that. Detecting this parasite in food is genuinely hard, and a lab that catches its own error and says so out loud is doing the job right.

A corrected PCR result is not an apology, and a company does not get to convert one into the other on its own website. 

Notice also what quietly changed in the language. On July 17 Taylor Farms said FDA’s traceback pointed at a specific independent farm representing less than one percent of the U.S. iceberg supply. That sentence is gone from Sunday’s version. The FDA, meanwhile, says the data converge on Taylor Farms locations in central Mexico — plural. Sympathy for the sick, which opened the July 17 statement, now sits in the fourth paragraph. 

And here is the part that no amount of sampling was ever going to fix. The people in this outbreak got sick beginning in mid-May. The recalled product was distributed from June 29 to July 16. Lettuce is perishable and the lag between the first illness and the first traceback was measured in months. The lots that sickened more than a thousand confirmed cases — against state-reported numbers many times higher — were eaten and thrown away long before anyone thought to swab anything. A negative product sample in a Cyclospora outbreak, or the absence of a positive one, proves nothing. The victims ate the evidence in May. I wrote about why that is, and what it would take to change it, on Sunday night.

FDA’s recall notice is still up. FDA is still telling people not to eat the product. The word implicated survived the false positive. If anyone at Taylor Farms believes otherwise, the company is free to say so plainly, publish the lot codes it promised, and name the customers behind those brand codes. That would be worth more to the public than an apology it did not receive. My first take on Sunday’s statement is here.

And, as of today, here is the updated list of the 50 State Cyclospora count:

Added up, what the fifty state health departments are actually reporting for 2026 comes to roughly 10,200 cases – more than six times the 1,644 the federal government has confirmed. Michigan alone added 1,146 cases between Friday and Monday. States count differently, and some of these totals include travel-associated illness, so this is a floor and not a precise figure. It is still the only number anyone has that reflects what the states themselves are seeing. Where a state has published no 2026 count, the entry reads “not separately reported” – which is itself the point. A state that is not counting cannot tell you whether it has any.