I laid out eight things last Friday morning on FSN that Washington should have done about Cyclospora. The obvious objection to a list like that is money — that food safety is expensive, that budgets are finite, that somebody has to pay for it. I want to take that objection seriously, because when you actually put the numbers side by side, it collapses. The eight things are cheap. What happened instead is not.

Start with what the federal government itself says this parasite costs. USDA’s Economic Research Service publishes a cost-of-foodborne-illness estimate covering thirty-one pathogens. Cyclospora cayetanensis is one of them, and its line reads: 11,407 cases a year, $464.63 per case, $5.3 million a year for the entire United States.

The Microbiological Data Program, which tested about fifteen thousand produce samples a year — bagged lettuce and spinach, cilantro, hot peppers, tomatoes, sprouts, melons — and accounted for something like eighty percent of all federal produce pathogen testing until it was shut down in December 2012. It cost $4.5 million a year. The entire national testing program cost less than what one parasite costs the country annually, and I have been asking for it back since 2024.

Four things are wrong with the $5.3 million. First, the 11,407 is Elaine Scallan’s 2011 figure, unchanged — ERS’s dollar estimate is riding on a fifteen-year-old case count. Second, ERS says plainly on its own page that these numbers are conservative because they exclude willingness to pay to prevent non-financial harm, including pain and suffering. For an illness that relapses in waves across weeks, that is most of the injury. Third, they exclude industry losses entirely. No restaurant sales. No lettuce. No recall. And fourth, they do not contain a dollar of what it costs to fight about any of it.

Then it produces a summer like this one. The fifty-state count on Friday afternoon was 21,452 people, which is 1.88 times ERS’s estimate of every Cyclospora case in a normal year. Run only the counted cases at ERS’s own per-case cost and you get $9.97 million — already nearly double the agency’s entire annual national figure. Run the Scallan-adjusted estimate of 557,352 illnesses and you get $259 million. Both are floors, because neither includes a dollar of what follows.

Here is what follows. Yum Brands reported Thursday that Taco Bell’s US same-store sales are down 2% for the third quarter through July 27. Its stock has fallen roughly five to eight percent since the chain was linked. On Friday July 17, the first Friday after the link became public, Taco Bell’s foot traffic fell about sixteen times worse than the broader fast-food category, which was down 1.9% that day.

And the damage did not stop at the company with the lettuce. Chopt was down 12% in traffic as of July 23. Sweetgreen’s weekly spending fell ten percentage points against last year across the first half of July. Sweetgreen has said its food is not linked to this outbreak, and no state has tied an illness to either chain. They lost the money anyway. Grocery shoppers are buying less lettuce, and some large buyers have stopped sourcing from central Mexico altogether.

Go one step further back and it reaches the grocery store. Stew Leonard’s runs eight stores across New York, New Jersey and Connecticut, and its chief executive told CBS News that lettuce sales are down about eleven percent and that there is “a lot of confusion on store floors right now.” Behind that anecdote is the scanner data: NielsenIQ recorded US fresh lettuce unit sales in the week ending July 18 down nine percent from the week before and nineteen percent from two weeks before.

And one step further back still, to the growers. Paul Sellew founded Little Leaf Farms, which grows lettuce in the eastern United States — not Mexico, not Salinas, no connection to Taylor Farms or to any recalled product. His sales are down by double digits. His account: “The consumer has been motivated by fear.” He also says the entire fresh produce category at retail is down. A grower two thousand miles from Guanajuato is paying for Guanajuato.

The trade associations have said very little about any of this, and one of them said something more useful than it may have intended. The National Restaurant Association now tells its members that washing produce under clean running water “cannot guarantee removal of the parasite.” That is the restaurant industry’s own trade group putting in writing exactly what the White House press secretary told the country to do on July 16, and it joins FDA’s guidance document and CDC’s health advisory in saying so. Three sources. One of them had every commercial reason to say something else. What no trade association has done, more than six weeks in, is put a number on what any of this has cost its members.

One publication did say something useful this week, and it came from a direction that carries more weight than mine. On Friday the editorial board of the Delmarva Farmer, a paper written for the people who grow this food, called for exactly the traceability infrastructure that has been shelved. Its account of the harm is better than the one I have been making. Food moves in hours while outbreak investigations take weeks, and in that gap, retailers turn cautious, buyers hesitate, whole commodity sectors watch sales fall, and growers who followed every protocol lose their market because they happen to raise the same crop as the eventual suspect. Its prescription is electronic purchase records, standardized lot coding, interoperable supply-chain databases and real-time data sharing — which is the contents of FSMA 204, described by a farm paper without the rule’s name attached to it. It observes that agriculture has spent billions over two decades on water testing, worker training, sanitation and third-party audits, and argues those investments deserve to be matched by equally modern systems for detection and traceback. It closes by saying it is “time for the public health infrastructure that protects it to catch up.”

That fourth exclusion is the one I know best, because it is my job. The ERS figure holds nothing for what Taylor Farms will spend defending these cases — the lawyers, the experts, the document review, the depositions, the years of it. It holds nothing for what my side spends building them. And it holds nothing for what eventually reaches the person who was sick. Look at what the money is paying for. It is paying for precisely the pain and suffering that ERS declined to value and said so. The tort system puts a price on the one term the cost-of-illness model leaves deliberately blank. The two numbers are not in conflict; one of them is measuring the part the other refused to measure.

The legal fees are money spent establishing who is responsible for something that should not have happened, which buys nobody a single healthy day. And there is a hard public number for it. After the 1993 outbreak, Jack in the Box sued its own meat suppliers and recovered about $58.5 million. Its annual report to the SEC records that roughly $45.8 million of that was left after litigation costs. Nearly thirteen million dollars, consumed by one recovery action arising out of one outbreak, and not one cent of it made anybody well. That is a line-item ERS does not have, and it recurs in every outbreak, on both sides, every time.

As for scale, my first case is still the clearest illustration I have. Brianne Kiner spent forty-two days in a coma and more than five months in the hospital, and her case settled for $15.6 million in 1995. One child. One settlement. Nearly three times what the federal government today says Cyclospora costs the entire United States in a year. I am not suggesting cyclosporiasis is that illness, and it is not — Brianne lost most of her colon and has been diabetic ever since. The comparison is not about what a case is worth. It is about the distance between what the tort system finds when it looks at one injured person and what a federal cost model finds when it looks at a whole country. Those two systems are not measuring the same thing, and only one of them is used to decide whether a $4.5 million testing program is worth restoring.

We do have a measured figure for the last comparable event. Spalding and Sexton, in the American Journal of Agricultural Economics, put the total societal loss from the November 2018 romaine outbreak at $276 to $343 million. Their own conclusion is the argument I am making: the episode demonstrates the economic benefit of adopting mandatory food-safety standards and improved traceability. For 2006 spinach, USDA’s retail scanner work found $60.6 million in lost consumer grocery spending on all fresh leafy greens over the following fifteen months, and packaged spinach sales were still off about twenty percent a year later.

When the agency proposed pushing the FSMA 204 compliance date from January 2026 to July 2028, it had to run a regulatory impact analysis. That analysis is in the Federal Register, and its arithmetic is not ambiguous. The benefits of the delay are up to a negative $322 million a year. Those are the public health benefits the country gives up by waiting. The cost savings on the other side — what industry keeps by not having to comply yet run about $73 million. This is not my number, and it is not an advocacy group’s number. It is the agency’s own table, in the Federal Register, under the heading Summary of Benefits, Costs, and Distributional Effects.

The second detail is the signature. The proposed rule is signed Robert F. Kennedy, Jr., Secretary, Department of Health and Human Services. Eleven months later the same Secretary told reporters that this outbreak was under control, at a moment when the count was 1,644 in five states. It is now 21,452 across fifty. I do not say he caused it. I say the traceability rule that would have shortened the traceback carries his signature on the paper that delayed it, and that the paper itself says the delay loses money.

On one side: a memorandum, a reporting requirement, some state code, $4.5 million a year, and a rule that is already law. On the other side: a parasite the government prices at $5.3 million a year that has already produced $9.97 million of counted illness by the government’s own per-case figure and plausibly $259 million once you adjust for the cases nobody counted; a comparable produce outbreak measured at $276 to $343 million; a fast-food chain down two percent and its stock down as much as eight; two salad chains with no link to anything down ten and twelve percent; and a delay the agency itself scored as a net loss of nearly forty million dollars a year.

Food safety is not expensive. Outbreaks are expensive. We have spent this summer proving it again, at the expense of twenty-one thousand four hundred fifty-two people who did not get a vote, and at the expense of a great many businesses that did nothing wrong except sell lettuce.

I published a fifty-state count of 20,927 this morning when about to fly home after spending the week at IAFP in NOLA. It is now 21,452 – so much for “Under Control.”

Three states have moved since, and a fourth row in that table was wrong. Michigan added 387 people in a single day and now reports 10,773 cases, with hospitalizations holding at 193 because the state refreshes that figure only on Thursdays. West Virginia posted its Friday update and went from 245 to 268, still with 19 hospitalized. New York moved from 666 to 753, and that number now comes from the state health department itself rather than a secondhand roundup. The new fifty-state total is 21,452.

The fourth change is a correction I owe the reader. My table carried Alabama as publishing no count at all. Alabama has been publishing one since at least July 15. The Alabama Department of Public Health reported 28 cases as of July 20, two of them hospitalized, none fatal, with four tied to international travel and eight tied to two separate foodborne outbreaks at Mexican-style restaurants that the department says plainly are not Taco Bell. That last detail matters more than the twenty-eight does. Alabama does not connect those restaurant clusters to Taylor Farms and neither do I. What it does is put a second state alongside New Hampshire where a health department has named an eating establishment that has nothing to do with a Taco Bell, and it sits with North Carolina pointing at parsley and cilantro and with the six separate Cyclospora investigations FDA still has open on its own table. One recall does not explain over twenty-one thousand people, and I have never said it did.

The correction moves two of my own running lines. The number of states publishing no count of their own drops from fourteen to thirteen. And the group I have been describing for two weeks as states that received the recalled lettuce while publishing nothing about their own residents is down to two. It was Alabama, Mississippi, Missouri and South Carolina. Missouri fell out on Thursday at 593. Alabama falls out now. Mississippi and South Carolina are what is left.

One more thing surfaced in the sweep, and it is another argument for reading every number in the table below as a floor. Three states now publish two different totals, and I have been taking the smaller one every time. New York reports 753 since May 1 and 787 for the calendar year. North Carolina reports 718 since May 1 in its press release and 728 for the year on its own dashboard. Florida reports 254 since May 1 and 264 since January 1. 

Ohio held at 4,013 statewide today, and the county problem inside it got cleaner rather than smaller. Both figures are now dated July 31. The state puts Lucas County at 554. The Toledo-Lucas County Health Department puts Lucas County at 1,207, with 3,016 across northwest Ohio. 

Against all of that, the federal picture has not moved at all. CDC’s outbreak page still says 1,947 people and 98 hospitalizations across nine states, where it has sat since July 24. Its surveillance page still carries 6,707 laboratory-confirmed cases plus more than 11,500 awaiting confirmation across 45 states, published Tuesday and covering reports through July 27. Add those two federal figures together and Atlanta is describing 18,207 people. The fifty states describe 21,452. The two are 3,245 apart, close to eighteen percent, with the states higher. The named outbreak is now 9.08 percent of the illness this country is reporting.

Where each state stands tonight, with the source for every number.

Thirteen states in that table publish no count of their own. CDC says 45 states have cases, which means there are at least nine states where the federal government knows there are confirmed illnesses and a resident cannot look up how many. Thirteen more of these numbers trace to a single national roundup that has not been updated since July 17. Every figure above is a floor, and Alabama is tonight’s proof that a blank cell has never meant no illness. It has only ever meant that I had not found the answer yet.

Taylor Farms put up a new page on its website on the evening of July 30, and as far as I can tell nobody has written about it. It is not the newsroom statement everybody has been quoting for two weeks. It is a separate Cyclospora information hub, and buried in its frequently asked questions is the first number the company has ever published about its own testing: approximately two thousand samples taken in central Mexico since May, every one of them negative.

First, to be clear, Taylor Farms has only been linked to the nine-state Taco Bell cluster and the New Hampshire hospital cluster. It has not been linked to the thousands of ill in states that received its recalled products.

Taylor Farms has been talking since July 17, and it has never once said the same thing twice. Five versions have gone out under the same corporate letterhead in fourteen days, and the differences between them are the story.

The first version, July 17, is the one that matters most and the one the company has said least about since. It opened with concern for the people who got sick, for their families, and for Americans whose trust in produce safety had been shaken. It said the removal was based on information FDA had provided the day before. And it acknowledged, in the company’s own words, that FDA’s traceback was pointing at a specific independent farm representing less than one percent of the United States iceberg supply. That statement was written before any product sample existed anywhere. The recall was July 17, the reported positive was July 18, and the retraction was July 19. Whatever the company argues later about laboratory evidence, it conceded on July 17 that this recall was driven by traceback and epidemiology, and it conceded it in writing.

The second version went up on July 19, at the same web address, and it reads like a different company wrote it. It led with the claim that FDA had apologized. It recounted the false positive. It stated that FDA had not identified a single positive product test. Sympathy for the sick dropped from the first paragraph to the fourth and got shorter. The phrase about an abundance of caution appeared for the first time. The recall was recast in the completed past tense. And the July 17 acknowledgment of FDA’s traceback was gone. There is no apology anywhere in FDA’s public record. What the agency actually did was correct a laboratory result and notify the firm, and in the same breath it said it was continuing to work with the firm to make sure product implicated in this outbreak came off the market. The word implicated survived the false positive. FDA said the removal was ongoing on the same day the company said the recall was complete.

The third version, July 20, was titled as a summary of the facts and added that the company would not be sourcing central Mexico iceberg for the rest of the growing season. The fourth version, July 24, is the one that still sits at the top of the newsroom page: two hundred million dollars a year in independently audited food safety protocols, implicated product removed immediately, a broader recall out of an abundance of caution, iceberg sourcing and all central Mexico production suspended since July 18, independent experts commissioned for a top-to-bottom review, and no confirmed positive product tests as of July 24. That page now stacks every prior version underneath the current one, which means the July 17 language is back on the site as an archive entry. I said two weeks ago that the company had edited its record the way the regulator edited its lab result. Half of that has been undone, and I will say so.

Nothing new was written for six days after that, but the company kept talking. On July 27 a spokesperson answered CBS News about the House Oversight letter from Representative Robert Garcia by not answering it, and repeating the July 24 lines. On July 30 a spokesperson gave NewsNation what was, word for word, the July 24 text. A July 24 script is a strange thing to hand a reporter on July 30 in an outbreak that added more than a thousand cases in between, and the sentence about no positive tests as of July 24 gets less impressive every day it is repeated without a new date on it.

Which brings us back to the page that went up on the evening of July 30. It carries its own statement, the recall table, a long section on the company’s food safety program, and the questions. The questions are where the news is, because five things appear there that Taylor Farms has never said anywhere else.

The first is that number. Two thousand samples in central Mexico since May, all negative. That is the first time Taylor Farms has quantified its own sampling in this outbreak, and it is going to be the most consequential sentence on that page. Two thousand samples of what, taken where, on what dates, in what matrix, by which method, held under whose chain of custody, and how many of them were water rather than product. A company that volunteers a denominator has volunteered the question.

The second is a concession dressed as a boast. The hub says the recall was made voluntarily, before FDA asked us to, and that it was broader than the lots FDA’s traceback suggested. Read that twice. It confirms that by July 17 FDA’s traceback had already identified specific lots. The third is the company’s affirmative position on the science, stated plainly for the first time: epidemiology is a legitimate investigative tool, but it cannot confirm that a specific product caused illness, and that confirmation requires a positive laboratory test of the product. That is not a public relations line. That is a defense, written down, on the company’s own website, while nine states and two federal agencies say the epidemiology is overwhelming and the traceback converged on one supplier. And, do not forget about New Hampshire. Seventeen of that state’s thirty-three confirmed cases trace to recalled Taylor Farms lettuce on one salad bar at Cheshire Medical Center in Keene, fifteen hundred miles from the Midwest and nowhere near a Taco Bell, in a state that identifies between two and nine cases in an ordinary year. No positive product test there either.

The fourth is the false positive, and the company has stopped claiming an apology. Asked what happened, the hub now says the question is best directed to FDA. The fifth is the first direct answer to the charge that the company has worked against traceability rules: the hub calls that absolutely false, says Taylor Farms is an industry leader in traceability, and says it has already implemented traceback protocols ahead of the compliance deadline. That last clause deserves a moment. There is no compliance deadline to be ahead of. The Food Traceability Rule’s compliance date was January 20, 2026, it came and went without taking effect, and Congress has directed FDA not to enforce it before July 20, 2028. A company can be ahead of a deadline that Congress removed, but nobody else has to be, and that is the entire problem.  Perhaps if Taylor Farms is in favor of the Food Traceability Rule it can work with me to mover the compliance date to now?

One more thing about that page, and it is small and it is telling. The hub lists the states the recalled product went to, and it lists twenty-seven of them. FDA added West Virginia to the distribution list on July 24, making it twenty-eight. West Virginia is one of the nine outbreak states, it reports 245 cases and 19 hospitalizations, and a week later the company’s own consumer-facing page still does not list it. Georgia is misspelled in the same sentence.

That is the company. Here is the size of it, as of 7:30 a.m. in the NOLA airport.

Ohio moved this morning, and it moved hard. The Ohio Department of Health now reports 4,013 cases in 80 counties, up from 2,576 in 78 counties on July 23. That is 1,437 people in a week, a jump of more than half. All but nine of the 4,013 got sick in June and July, most of them since June 20. Ohio’s published statewide figure had not moved since July 24. When it finally moved, it moved by fourteen hundred people.

There is something inside that number worth stopping on. ODH puts Lucas County, the hardest-hit county in the state, at 554. The Toledo-Lucas County Health Department puts Lucas County at 1,194. Same county, same week, two official counts, and one is more than double the other. This is not a one-day artifact. On July 23 the state said 435 and the county said 1,074. In mid-July the state said 278 while the county dashboard said 531. The state has been publishing roughly half of what the county publishes for the whole outbreak. I do not know which case definition each is using, and neither number is wrong on its face. What I do know is that the state’s figure is the one that travels to Atlanta, and the state’s figure is the smaller one. Cuyahoga County, up in the northeast where CDC sent field staff, is second at 459. Wood County, just south of Lucas, went from 309 to 446 in a week.

Two more states moved overnight. Arkansas went to 123 lab-confirmed cases in a July 30 update from the state health department, up 31 from the 92 it reported on July 27, with 75 of them in Benton County and 13 in Washington County. Indiana went to about 1,176, up from 1,092, which is a state that has more than doubled in eight days. Michigan holds at 10,386 as of July 30, and its hospitalization count, which MDHHS refreshes on Thursdays, went from 160 to 193 in a week.

Add up what all fifty states publish about themselves, one health department at a time, and the count this morning is 20,927. The head count crossed twenty thousand overnight, and Ohio is why. The nine states the government has named as the outbreak hold 17,666 of that. CDC’s outbreak page says the outbreak is 1,947 people. That is 9.3 percent of the illness being reported in this country right now. The official outbreak number is no longer within a tenth of the outbreak.

Michigan alone now reports 193 people hospitalized. CDC’s outbreak page reports at least 98 hospitalized across all nine states combined. One state’s own count of people admitted to a hospital is nearly double the federal figure for nine states. The two numbers are built on different bases: CDC’s 98 counts hospitalizations among the 1,947 people who reported eating at a Taco Bell, and Michigan’s 193 counts hospitalizations among its own 10,386. That is exactly the point. The federal number is not measuring the outbreak. It is measuring the questionnaire.

CDC’s other page, the surveillance page, carries 6,707 laboratory-confirmed domestic cases since May 1, plus more than 11,500 more that are not lab-confirmed or still need international travel ruled out, across 45 states, with 423 hospitalizations and no deaths. Those figures were published Tuesday, July 28, cover reports through July 27, and stand until the next weekly update on August 4. The outbreak page has not moved since July 24. It has now been frozen for seven days while the states added better than a thousand cases.

Add CDC’s own two surveillance figures together and the agency is describing 18,207 people. My fifty-state count is 20,927. The two are 2,720 apart, about fifteen percent, with the states higher.

One concession that belongs in the open rather than in a footnote. CDC’s 6,707 is domestically acquired cyclosporiasis by definition. My fifty-state total is not, because most states publish one number and do not split it. Where states do split it, the travel share is real: Florida reported 28 of 158 acquired outside the country, Virginia 31 of 126, Illinois 96 of 216 in mid-July, Kansas 17 of 55 at the same point. The eleven states that received none of the recalled lettuce are the most exposed to this, since New York is 666 of their 1,037. That makes 20,927 a count of reported cyclosporiasis, not a count of domestically acquired cyclosporiasis.

Fourteen states still publish no count of their own. CDC says 45 states have cases and only 36 states publish a number, which means there are at least nine states where the federal government knows there are confirmed cases and a resident of that state cannot look up how many. A blank cell in the table below has never meant no illness. It has only ever meant no answer. Fourteen more of the fifty numbers below trace to a single national roundup that has not been updated since July 17, so those are floors too. Every number in this table is a floor. Missouri, which went from a published 216 to a published 593 in a single week, is the proof.

Where each state stands this morning, with the source for every number.

Fourteen days, five statements, one number that got smaller every time it was restated and one that has never been published at all. The company has told us how much it spends on food safety, how many samples it ran, how many states it shipped to, and which agency to ask about the laboratory. Nobody has told us what is in the water where that lettuce grew. FDA asked that question in Guanajuato in 2013, in the last Cyclospora outbreak traced to the same company and the same Mexican state, and the answer was never produced. Twenty thousand nine hundred twenty-seven people later, it still has not been.

The first thing customers in metro Detroit knew about this outbreak did not come from a press release. It came from a sign taped up at the counter. In early July, signs appeared at Detroit-area Taco Bell restaurants telling people the stores could not serve lettuce, cilantro, onions, pico de gallo or guacamole because of a national recall. The company itself said nothing publicly for days.

When it finally spoke, on July 14, Taco Bell spoke to reporters rather than to guests, and only after the Washington Post reported that federal and state agencies were looking at the chain. The statement said that guest health and safety was the top priority, that public health officials had not confirmed a link to Taco Bell or to any specific ingredient, supplier, restaurant or retailer, and that the company had “voluntarily and temporarily removed limited ingredients at select restaurants” as a precautionary measure.

Read those two sentences next to each other. Nothing has been confirmed, and also, we have pulled the produce. Both of those things were true on July 14, and only one of them was volunteered as news.

Two days later the language moved. On July 16 the company said it had taken “immediate action to voluntarily remove potentially impacted lettuce from a supplier” in select states, according to NPR, following what it described to ABC News as “ongoing conversations with public health officials.” That same day it told NBC News by email that the lettuce was out of its supply chain nationwide and “indefinitely,” with replacement product in selected states within a day. It did not name Taylor Farms.

On July 17, the day CDC and FDA named the five states and identified Taylor Farms de Mexico as the single supplier, the company issued its fullest statement. It said public health is “a shared responsibility among restaurants, their suppliers, and authorities,” described itself as proud to have acted quickly and proactively throughout, and encouraged other restaurants, retailers and foodservice operators to take the same precautionary action, per CBS News.

Five days after that came the part aimed at customers rather than at reporters. Chief executive Sean Tresvant posted an open letter on LinkedIn thanking the people who had stayed loyal, promising transparency about what the company knew and what it would do next, and offering the line that got quoted everywhere: “We aren’t entitled to your loyalty. We earn it one meal at a time.” The next day the chain sold Enchiritos and nacho fries for a dollar. The following week it did the same with the Mexican Pizza. Every promoted item was lettuce-free.

The most recent word came on July 30, on the Yum Brands second-quarter earnings call. Chief executive Chris Turner told analysts the brand had taken a meaningful near-term sales hit that he expects to be temporary, described Taco Bell as in the early days of recovery, and said consumers increasingly understand this to be “an industry-wide issue, not an issue specific to Taco Bell.” The chief financial officer said the damage bottomed out the weekend of July 18 and that United States same-store sales were down two percent quarter-to-date through July 27. The earnings press release did not mention the outbreak at all. Only the call did, and only because analysts asked.

One more document belongs in this file, and it predates all of it. Yum’s most recent annual filing with the Securities and Exchange Commission named Cyclospora by name as a business risk, listed among foodborne pathogens at the top of the company’s own risk disclosures. That is not a statement about this outbreak. It is a statement that the company understood this organism was a foreseeable threat to its business before anyone got sick.

Now the three things nobody has said.

Taco Bell has never said when it, or any of its franchisees, first received a complaint from a sick customer. It has never said what it knew about its supplier when it bought shredded iceberg lettuce grown and processed in central Mexico. And it has never said when it first had enough information in hand to do something to protect the people it was serving. None of those questions can be answered from press statements. They are answered from records and under oath.

The July 14 statement is where the pressure sits. Product does not come off a prep line for nothing. Something generated the decision to pull lettuce, cilantro, onions, pico de gallo and guacamole from restaurants in Michigan, and that something was written down. Whatever it was, it existed before July 14, because the signs were already up. The interval between that first internal decision and the July 16 nationwide removal is the whole question in this case. A company that says it consistently acted quickly and proactively will have to prove that against its own timestamps.

The records that answer it are ordinary and they exist. Local health departments keep complaint and inspection files on individual restaurants, and those can be obtained by public records request without waiting on anyone’s discovery obligations. Yum operates a guest-relations system that generates a dated ticket every time a customer calls or writes to report an illness, with a free-text field describing symptoms and an escalation threshold that triggers quality-assurance review. Franchisees file their own incident reports, and there are at least three separate reporting streams here, because Pacific Bells, Border Foods and corporate Taco Bell are three different operators serving the same lettuce. Then there is the supplier approval file: the specification, the audit reports, the sourcing terms for Mexican product, and whatever testing was or was not required of it. And there is the internal memo, or the email chain, or the distribution instruction that took the produce off the line in the first place.

The purchasing question has an answer too, and it is uncomfortable for the buyer. This supplier is not a stranger to this parasite. Cyclospora has been traced to product grown and processed in central Mexico before, in an outbreak that produced a public commitment to sample the water and thirteen years of not doing it. Product from Taylor Farms turned up behind outbreaks over the decades. A buyer who names this organism in its own securities filing as a leading risk and then sources ready-to-eat shredded iceberg from a region with that history, is going to have trouble arguing that any of this was a surprise. That will be a fun, under oath deposition,

There is one complication worth flagging before anyone overstates the case. CDC’s own investigation page says that not all Taco Bell locations sourced their shredded lettuce from the same supplier, while the traceback converged on Taylor Farms de Mexico for the locations where sick people ate. That cuts in more than one direction, and it is a fact to pin down in discovery rather than to argue around.

Everything above is public. The company’s statements have been consistent in one respect throughout: they describe what was removed, and never when the company learned it should be removed. That second date is the one that matters, and the only place it exists is inside the company.

My flight got cancelled from New Orleans to Seattle tonight, so I am listening to good Jazz and thinking diarrhea too much.

At the International Association for Food Protection meeting this week, more than one person who knows this organism well came up to me to say that public health had it wrong. The Cyclospora outbreak, they said, is not Taylor Farms lettuce from central Mexico. It is American sewage infrastructure — the same story as Milwaukee in 1993, when a failure at a drinking water plant put Cryptosporidium into the tap and made something like 400,000 people sick in a couple of weeks. These were friends and serious people in a hallway at the biggest food safety conference of the year, and the argument deserves an answer rather than a wave of the hand.

Here is the answer, and it starts with a concession, because the half they have right is the important half. Cyclosporacomes from exactly one place. Human feces. There is no cattle reservoir, no wildlife reservoir, no soil reservoir. Every outbreak of this parasite in history began with somebody’s waste reaching somewhere it should never have been. Former FDA Commissioner Scott Gottlieb said the same thing on Monday, describing a contamination event that could have reached multiple fields of differing products at once through irrigation water, through flooding, through overflowing portable toilets used by farmworkers, or through a break in a sewage canal. In his words, “there was some event that happened in central Mexico. We don’t know what yet.” He had put it more plainly two days earlier on Face the Nation: the only known reservoir for this parasite is human fecal matter, so sewage probably reached those growing fields and contaminated the crops, and nobody is sure yet how. Sewage is the mechanism. Nobody serious disputes that.

Where the hallway argument falls apart is the continent, and the biology settles it in one sentence. Cryptosporidiumoocysts are infectious the moment they are shed. That is precisely why raw sewage reaching a municipal water intake could sicken a city in two weeks. Cyclospora oocysts are not infectious when they are shed. They have to sit in the environment for days to weeks and sporulate before they can infect anyone at all. Sewage entering an American wastewater system carries Cyclospora that cannot yet make a person sick. The Milwaukee mechanism does not work for this parasite.

That same fact also tells you when the contamination happened. Because the oocysts need a week or two out in the world before they can infect anybody, whatever fouled this lettuce and possibly other products did it at least that long before the first person ate it. Not in a kitchen. Not on a cutting board. Not in a processing plant, where the lettuce spends hours rather than weeks. This happened in a field, or in water that reached a field. The parasite’s own life cycle puts the contamination outdoors and upstream, which is exactly where nobody has been looking. That is not a lawyer’s argument. It is in the textbooks and in CDC’s own description of the organism.

The second problem is supply. Where would the oocysts have come from? Cyclospora cayetanensis is specific to human hosts and is not yet endemic to the United States. Britain’s health agency said flatly last week that it does not naturally occur there, and something close to that is true here. I use the word yet deliberately, and so does Gottlieb — he told CBS that before roughly 2016 or 2017 this species was not seen in American-grown produce at all, and that when it did begin turning up in California produce it was at far lower levels than what comes out of Mexico and South America. That is a trend worth watching and I am not going to pretend otherwise. It is also nowhere near enough to make American sewage the engine of a nineteen-thousand-case summer. Domestically acquired American cases are still overwhelmingly traced back to fresh produce grown where the parasite is endemic. American sewage does not yet carry this organism at scale because Americans are not yet carrying it at scale.

There is a natural experiment sitting right on top of that, and it was published while I was at the conference. The UK Health Security Agency reported 67 cyclosporiasis cases in returning travelers this spring and summer. Travel information exists for 52 of them, and 48 had been to Mexico. Those same people drank British tap water the other fifty weeks of the year and did not get this parasite. CDC counts travel-associated cyclosporiasis separately from domestic cases and is well past a thousand of them across more than forty states. If North American sewage infrastructure were driving this, the travel signal would run the other direction — you would expect Britons who never left Britain to be getting sick, and Britons returning from Mexico to be fine. The data says the opposite, on two continents, in two national surveillance systems that do not talk to each other.

The third problem is geography. A water utility is a bounded thing by definition. Milwaukee was one service area fed by one treatment plant. This outbreak is nine states in CDC’s cluster and forty-five states in its surveillance data, and those states share no water system with one another. The theory requires dozens of unrelated utilities failing in the same summer and failing in the same way.

The fourth problem is the shape of the curve. Milwaukee produced a community-wide attack rate that hit everyone on the same tap, small children included, inside of about two weeks. This outbreak has run for ten weeks with a median age of 44 and a range from two to ninety-five, and it is concentrated in people who reported one particular restaurant exposure. Michigan analyzed food exposure details from 190 people in that cluster and gave them to CDC. Roughly nine in ten had eaten iceberg lettuce. The state has since done more than two thousand interviews and calls the evidence on shredded iceberg very strong. Tap water does not select for people who ate at one chain.

The fifth problem is that traceback does not run on water. FDA’s convergence on a single supplier came out of invoices, bills of lading and distribution records, and it came before any laboratory result existed at all. Paper trails lead to a shipper. They do not lead to a wastewater plant.

And then there is New Hampshire, which I think should have ended the conversation in the hallway. State health officials have now tied seventeen confirmed cases to recalled Taylor Farms lettuce served in the cafeteria at Cheshire Medical Center in Keene, with an exposure window running from the beginning of June through July 20. It started at nine. Dartmouth Health separately identified sixteen people exposed in connection with the outbreak, ten of them its own employees, and said it believes some were infected through Taylor Farms lettuce on the hospital’s salad bar before the recall. Phyllis Entis at eFoodAlert caught what mattered about it: this is the first time a state or federal agency has explicitly linked cases in this outbreak to an establishment other than a Taco Bell.

Now run the sewage theory through the hospital cafeteria. That hospital is roughly fifteen hundred miles from the Midwest cluster. For American wastewater to explain those seventeen people, Keene’s water system would have to have failed independently, during exactly the weeks that recalled lettuce sat on that one salad bar and then sickened only the people who ate in that cafeteria and nobody else in the city. What actually happened is simpler and it is the ordinary story of a contaminated ingredient. One product moved through two entirely unrelated food systems fifteen hundred miles apart and made people sick in both. That is what a bad lot looks like. It is not what a water main looks like.

There is also the small matter that this is the second time. In 2013, FDA traced a cyclosporiasis outbreak in Iowa and Nebraska to salad mix from this same company’s operation in Guanajuato — 227 confirmed cases in those two states, and a later traceforward investigation tied romaine from a single Mexico-origin field to 189 cases across seven states. I want to be careful here, because the national 2013 total of 631 cases in twenty-five states was not all one outbreak; Texas had its own cluster that traced to cilantro from Puebla, a different grower entirely. But the Iowa and Nebraska half is documented in FDA’s own environmental assessment and in CDC’s summary. Thirteen years apart, the same parasite, the same company, the same Mexican state. American municipal sewage does not explain why that particular place keeps turning up.

There is a more sophisticated version of the hallway argument, and it deserves a better answer than the one I gave in the hallway. Nobody who stopped me was alleging a conspiracy. What they were describing is anchoring — everyone locking onto the first hypothesis and then finding what they went looking for. That happens in outbreak work, it happens without a single person colluding, and it has happened before. In 2008, FDA and CDC pointed publicly at raw tomatoes in a Salmonella outbreak, growers lost a season, and the vehicle turned out to be jalapeño peppers and serrano peppers. I am not going to argue that a lot of agencies agreeing settles anything. Nearly half the country tells pollsters it does not have much confidence in FDA to handle this outbreak, and I have spent this month giving them reasons.

The argument I would make is a different one, and it is about independence rather than agreement. This finding does not rest on one method. Michigan’s state epidemiologists built it out of more than two thousand case-control interviews, and Gottlieb’s own criticism of the federal response is that Michigan led that work when CDC should have. FDA’s traceback is a documentary exercise, run by a different agency, out of invoices and shipping records. New Hampshire is a third state, a different setting, and no Taco Bell in it at all. Those three do not share a failure mode. Recall bias in a patient interview does not propagate into a bill of lading. A traceback error does not conjure a hospital cafeteria cluster in Keene.

And the cafeteria cluster in Keene is the specific answer to anchoring. Anchoring predicts that you find more of what you are looking for in the places you are already looking. It does not predict a hospital salad bar fifteen hundred miles away, in a state nobody was watching, turned up after the hypothesis already existed by people who were not trying to test it.

I am not going to tell you that Taylor Farms explains all of the more than nineteen thousand illnesses, because it does not and the record says so. CDC has written into its own investigation page that not all Taco Bell locations in the outbreak states received shredded iceberg lettuce from the same supplier. FDA has six Cyclospora investigations open right now, and the largest one with no identified source climbed from 72 cases to 93 this week. North Carolina’s investigators keep hearing parsley and cilantro. The chief medical health officer in Wayne County, Michigan says one recall does not tell the whole story, and she is right. Taylor Farms explains the nine-state cluster, and it explains Keene. Something else explains part of the remainder. Neither of those things is a sewage plant in Ohio or Michigan or the water in the Great Lakes.

Here is why the hallway argument gets traction anyway, and this is the part that should trouble everyone who was standing there. There is no water data. In 2013, after this same company’s Guanajuato plant was tied to an outbreak that sickened hundreds of Americans, Taylor Farms told FDA it would test the water at Doctor Mora, and the plant reopened partly on the strength of that commitment. Thirteen years later I cannot find a single published result. And the one piece of water data that does exist in the record is not reassuring: FDA’s 2013 assessment team, going through the company’s own irrigation testing records, found a positive fecal coliform result off drip irrigation tape that triggered no corrective action, because the rolling five-sample average the firm used never tripped. Cofepris took four water samples in July and reported them negative — four samples, three days, one facility, taken after the implicated harvest was already eaten. When there is nothing in the hole where the evidence should be, serious people fill it with theories, and some of those theories point at the wrong hemisphere.

I will say what would change my mind, because anyone making an argument this loudly owes that. Recover Cyclosporafrom an American municipal water system, genotype it, and match it to the people who got sick. Show me a domestic water source and a patient sharing a marker. That is the evidence that would move me off the lettuce, and I would write that post the same week. It does not exist. Nobody has produced it, nobody at IAFP offered it, and the reason is not that somebody looked and came up empty. It is that nobody has looked at all — here or, more to the point, there.

The fix is not complicated, and it is not new. Sample the water where the lettuce grows. Irrigation sources, canals, and worker sanitation, on a schedule, with the results published whether they come back negative or not. Gottlieb named four plausible routes on Monday and every one of them can be tested for. Until somebody does that work, we will keep having this argument in hotel hallways instead of in the record, and the next outbreak will arrive before the last one is explained.

The people who stopped me at IAFP have the right parasite and the right mechanism. Human waste got into a food that nobody cooks. They simply have it happening in the wrong hemisphere, and the only reason that argument can be made with a straight face is that nobody has bothered to go look in the right one.

I hope to get home tomorrow – I like NOLA – but it is damn hot and humid.

Two questions crossed against each other for all fifty states: did the state receive iceberg lettuce that Taylor Farms de Mexico recalled on July 17, and does the state publish a 2026 Cyclospora count of its own.

CDC published its weekly surveillance update on Tuesday, July 28, and it finally answered the two questions this map had been unable to answer for a week. How many states, and how many hospitalizations. The answers are 45 statesand 423 hospitalizations, against 6,707 laboratory-confirmed domestic cases for the period May 1 through July 27. The agency updates that page once a week, on Tuesdays, so those figures stand until August 4.

Hold those next to what the same agency says on a different page. CDC’s outbreak page still reads nine states and at least 98 hospitalizations, and it has read that since July 24. One arm of CDC says 45 states and 423 people were sick enough to be admitted to a hospital, and another arm of CDC says nine and 98. Both numbers are current. Both are correct. They differ by more than a factor of four because they are answering different questions, and only one of those questions was ever about a parasite. The other was about whether you ate at a Taco Bell. CDC says so in its own footnote: the 1,947 counts people who ate at a Taco Bell in one of the nine states, including people who were only traveling through.

The surveillance page carries 6,707 laboratory-confirmed domestic cases, up roughly 2,500 from the July 21 update, plus more than 11,500 more that are not laboratory confirmed or still need international travel ruled out. The state count went from 41 to 45 in that same week. Sick people range in age from 1 to 98. No one has died. The agency estimates a six-week lag between when somebody gets sick and when the case reaches Atlanta, which means every one of these figures describes a June that is already over.

Here is the arithmetic. Add CDC’s own two figures together and the agency is describing 18,207 people, which is how the American Hospital Association reported it. Add up what all fifty states publish about themselves, one state at a time, and the total is 18,687. Those two numbers were built by completely different methods, and they land within about two and a half percent of each other. Two independent counts of this outbreak now agree on roughly eighteen and a half thousand people. The number the government calls the outbreak is 1,947. That is under eleven percent of it.

Five states moved on this table since last night, and every one of them moved up. Kansas nearly doubled in a week — KDHE reported 461 cases on Wednesday, up from 289, with 20 hospitalized, 405 of those cases in July alone, and roughly 190 interviews still pending. West Virginia is at 245 with 19 hospitalized as of July 28, not the 226 this table carried. Illinois is at 532 and Pennsylvania is at 82, per CNN’s tracker as of Wednesday. And Florida jumped to 254 in Thursday’s state report, covering illnesses through July 25, up from 158 a week earlier. Its weekly series since May 1 now runs 50, then 96, then 158, then 254. Pennsylvania is worth pausing on too. Cyclosporiasis is not a reportable condition there — CDC’s own footnote says Pennsylvania cases are reported voluntarily — and it still nearly doubled.

Michigan is unchanged at 10,077 since Wednesday, up 397 in a day, in a state that identifies about fifty cases in an ordinary year. But MDHHS attaches a caveat to its own numbers that deserves to travel with them: the July 27 total included roughly 475 cases that had not previously been reported to the state because of delayed laboratory reporting, and the department says plainly that those do not reflect a sudden increase in illness. Some of this curve is the parasite. Some of it is the laboratory catching up. Anyone quoting a daily jump should say which. Michigan has now completed more than 2,000 interviews and calls the evidence pointing at Taylor Farms shredded iceberg very strong.

In Ohio, the regional number has now passed the state one. The Toledo-Lucas County dashboard reports 2,856 cases across northwest Ohio and 1,183 in Lucas County as of Wednesday. The Ohio Department of Health’s statewide figure is 2,574 and has not moved since July 24. A corner of Ohio is reporting more illness than Ohio.

Which raises the thing I want to flag about this table rather than bury in it. Fourteen of the fifty numbers below trace to a single national roundup, and that roundup has not been updated since July 17. Its Michigan entry still says 4,312. Its Ohio entry still says 177. Those two states have since gone to 10,077 and past 2,500. There is no reason to think Arizona, Colorado, Georgia, Iowa, Louisiana, Maryland, Massachusetts, Minnesota, Nebraska, Rhode Island, Tennessee, Utah and Wisconsin are frozen in real life; they are frozen in the only public record I can find. Nebraska is the clearest example: it sits here at 49 from July 17, and on Wednesday the Lincoln-Lancaster County Health Department alone reported 33 cases in July, 30 of them acquired in this country, and said that is above what it normally sees. One county is most of the state’s published total. Every one of those fourteen numbers is a floor.

The nine outbreak states now hold 15,834 of the 18,687. CDC’s outbreak count for those same nine states is 1,947. That leaves 13,887 people who are sick with this parasite, in the nine states the government has already named, who are not in the number the government publishes — because they apparently did not report eating at a Taco Bell. Eighty-seven percent of the illness inside the outbreak states still sits outside the outbreak count.

The other sixteen dark-green states — the ones that received recalled Taylor Farms lettuce but are not among the nine — report 1,816 between them. Seventeen of those 1,816 have a named source (Taylor Farms lettuce), and all seventeen of them are in one hospital cafeteria in Keene, New Hampshire.

One honest limit on the number at the top of this page, before somebody else raises it for me. CDC’s 6,707 counts only people who did not travel internationally. The fifty-state total does not make that cut, because most states do not publish it. Where they do, the share is not trivial: Florida says 28 of the 158 it was carrying a week ago were acquired outside the country, Virginia says 31 of its 126, Illinois said 96 of 216 in mid-July, and Kansas reported 17 of 55 the same week. The eleven light-green states are the most exposed to this, because they are light green precisely for the reason that the recalled lettuce never reached them, and New York is 666 of their 1,037. That makes 18,687 a count of reported cyclosporiasis, not a count of domestically acquired cyclosporiasis, and I am not going to pretend otherwise.

It cuts the other way too, and harder. CDC estimates a six-week lag between illness and report. Cyclosporiasis is missed unless a clinician specifically orders the test for it, which is why CDC calls it underdiagnosed and underreported in its own health advisory. And none of these numbers include the people who got sick, stayed home, and got better. The comparison that survives all of it is the one inside the nine outbreak states, where state-reported illness is measured against state-reported illness: 15,834 against 1,947. Nothing about travel, lag or testing explains a gap that size, because both halves of it were counted the same way.

There is one more thing in the July 28 update worth sitting with. CDC now says 45 states have cases. Only 36 states publish a count of their own. That leaves at least nine states where the federal government knows there are confirmed cases and the residents of those states cannot look up how many. On the map below they are hatched, and hatching has never meant no illness. It has only ever meant no answer.

And we can now name some of them. The four states CDC added going from 41 to 45 were Oregon, South Dakota, Vermont and Delaware. Three of those four are hatched on the map below, which is to say the federal government has confirmed cases in South Dakota, Vermont and Delaware and none of those three health departments publishes a number. A resident of Dover who wants to know how much of this is in Delaware has to read a CDC surveillance page to find out that the answer is not zero, and still cannot find out what it is.

Every case number below, the color it produced, and a link to where it came from. Where a state publishes on a fixed schedule, that schedule is noted, because a number is only as fresh as the day its agency next opens the file.

A dark-green state is not a state where the lettuce is proven to have sickened anybody, and a light-green state is not a state where it is proven not to have. The map shows where product went and where illness was counted. What it keeps showing, six redraws in, is that the government’s outbreak number is not tracking the outbreak. It is tracking the questionnaire. CDC moved its own state count from 41 to 45 this week and its hospitalization count from something it would not publish to 423. Four more states moved yesterday. The outbreak page has not moved since July 24. Nor is the nine-state cluster the only thing open: on July 29 FDA raised a separate Cyclospora investigation with no identified source from 72 cases to 93.