Cyclosporiasis is the intestinal illness caused by Cyclospora cayetanensis, a parasite that reaches produce when human waste reaches a field or the water running through it. This summer it caused the largest outbreak of its kind in American history. Depending on which page you open, this summer either sickened 12,883 people, 19,595, or 33,548. Every one of those numbers is correct. They are different because they are not counting the same thing, and the differences between them are the story.
| Number | What it counts | Source, as of |
| 33,548 | Everything fifty state health departments have published this season, including probable and travel cases | My fifty-state table, September 8 |
| 19,595 | Laboratory-confirmed cases acquired in the United States since May 1 that meet CDC criteria | CDC case data, September 11 |
| 12,883 | Cases CDC and FDA attribute to recalled Taylor Farms de Mexico iceberg lettuce | CDC and FDA, September 11 |
What the fifty states report: 33,548
The largest published figure is not the government’s. It is the sum of what fifty state health departments have printed, as of September 8, and I keep it because nobody else does. States count what reaches them: laboratory-confirmed cases, probable cases, residents infected while traveling, and cases that have not yet cleared CDC’s criteria. Michigan alone reported 14,718 cases and 366 hospitalizations as of September 3, in a state that logs about fifty in a normal year. Forty states publish a number. Nine publish nothing at all. Four — Pennsylvania, Idaho, Mississippi and Nevada — do not make cyclosporiasis notifiable, so no figure was ever required to exist. Pennsylvania is one of the twenty-one outbreak states.
What CDC counts: 19,595, and 15,504 more it has not finished sorting
CDC’s national case-data page, updated September 11 with data through September 8, reports 19,595 laboratory-confirmed cases of cyclosporiasis acquired in this country since May 1, 1,043 hospitalizations, two deaths, and cases in forty-nine states and the District of Columbia. The comparable 2025 figure is 1,180. This season is more than sixteen times last season.
CDC’s criteria are narrower than a state’s: laboratory-confirmed, domestically acquired, inside the May 1 through August 31 season, and reported up the federal chain. The same page carries two numbers that almost never get printed. There are 9,355 additional laboratory-confirmed cases still being sorted into domestic or travel-related, and CDC says it is aware of at least 6,149 more that are not yet laboratory confirmed or are waiting on an interview. Add them together and the agency knows about 35,099 people. A separate series counts 1,997 travel-associated cases and 71 hospitalizations on top of that.
What is attributed to Taylor Farms: 12,883
CDC declared the iceberg lettuce outbreak over on September 11 at 12,883 illnesses, 570 hospitalizations, both deaths and twenty-one states, with the last illness beginning August 17. FDA’s advisory carries identical figures and says its own investigation continues, with samples from the inspections in Mexico still pending analysis. At the peak, before the July 17 recall, more than a thousand infections began in a single day. Through August the average was fewer than two a day.
Attributed means something specific here, and it is worth understanding. CDC’s definition is people who reported exposure to processed iceberg lettuce from Taylor Farms de Mexico, served or purchased at various locations. That is an interview, not a laboratory match. In August CDC added that genotyping shows the parasites from sick people are genetically related to one another, which is real evidence that they share a source. No product sample was ever confirmed positive.
Attributed to some other food: nothing
Not one 2026 cyclosporiasis case in this country has been publicly attributed by the federal government to any food other than that lettuce. Every open Cyclospora investigation FDA is carrying reads Not Yet Identified, and there are four of them on FDA’s table: 231 people in one, 38 in another, 22 in a third, 18 in a fourth. That is 309 people in files that have a pathogen, a case count and a traceback, and no food. None of the four has had an on-site inspection.
States have pointed elsewhere without confirming anything. North Carolina has said cilantro and parsley rather than the Taco Bell outbreak. New York traced an April cluster to cilantro at a Brooklyn restaurant and never confirmed it. Alabama named two Mexican-style restaurant clusters and said plainly they had nothing to do with Taco Bell. None of that is a federal attribution and none of it names a grower. It can be done: FDA closed a 2025 Cyclospora file naming parsley, with 69 cases in it.
Attributed to nothing at all: 6,712
Subtract the outbreak from CDC’s own confirmed count and 6,712 laboratory-confirmed Americans got this parasite this summer from a food nobody has named. Subtract it from the fifty-state total and the number is 20,665. These people were tested, diagnosed and counted. What they ate is simply unknown, and the season closed on August 31. Over the coming months I will be working with epidemiologists to find out where those infections came from.
Part of the answer may sit on FDA’s own page. Twenty-one states have cases in the Taylor Farms outbreak. The lettuce went to a great deal more of the country than that, and it did not go only to Taco Bell. Ten states received it, confirmed, and have no outbreak cases attributed to them at all: Alabama, Connecticut, Florida, Louisiana, Maryland, Mississippi, New Jersey, New York, South Carolina and Wisconsin. New York alone has reported more than nine hundred cases this season. Here is the whole footprint.
| Channel | Where it went | How many |
| Foodservice, distribution confirmed by FDA | Alabama, Arkansas, Connecticut, Florida, Georgia, Illinois, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maine, Maryland, Massachusetts, Michigan, Mississippi, Missouri, Nebraska, New Hampshire, New Jersey, New York, North Carolina, Ohio, Oklahoma, Pennsylvania, South Carolina, Tennessee, Texas, Virginia, West Virginia, Wisconsin | 31 states |
| Foodservice, may have been distributed further | Delaware, District of Columbia, North Dakota, Puerto Rico, Rhode Island, South Dakota, Vermont, Washington | 8 more |
| Retail, Marketside brand at select Walmart stores | Alabama, Arkansas, Florida, Georgia, Indiana, Kansas, Kentucky, Louisiana, Mississippi, Missouri, Oklahoma, Tennessee, Texas, Virginia, West Virginia | 15 states |
| Outside the United States | Mexico, where FDA says customer information from the firm shows the recalled product was sold to consumers | Not stated |
The company’s own July 17 notice listed twenty-seven states for the shredded iceberg product, four fewer than the list FDA now publishes: Maine, Nebraska, New York and West Virginia are on FDA’s and were not on the company’s. FDA’s recall record in its own enforcement database says twenty-seven states as well, and it also leaves West Virginia off.
Nobody thinks West Virginia did not get this lettuce. FDA named Taco Bell locations in West Virginia on July 16, the day before the recall, as one of the first five outbreak states, and West Virginia has counted its sick people ever since. The people who ate the product there were already in the hospital while the paperwork was being written. What the omission shows is that the distribution list attached to a recall is not a reliable map of where the food went. It is a list of who the company billed, assembled quickly, and it can leave out a state where the illnesses started. Thirty-one states is a floor too.
Every customer, and how much each one got
The recall notice named no customers. It identified the buyers by eight two-letter codes and published no volume at all. All of it was sitting in FDA’s recall enterprise database from the day the recall was announced, in a record called Event 99453, twenty-one separate product entries. I went through it entry by entry on August 9 and added it up. The recall covers 236,192 cases, a figure that appears nowhere on FDA’s website or in the company’s announcement, because the system lists the entries and never totals them. And the federal record spells out the codes.
| Customer | Cases | What the code was, and what is known |
| Marketside | 109,476 | Walmart’s house brand, and the only entry aimed at consumers. Four items, roughly ninety lot codes, ten to twelve bags to a case. Well over a million bags. |
| Taylor Farms | 68,897 | The company’s own label, code TF. |
| Cross Valley Farms | 19,016 | Code CV. The private label of US Foods. |
| Sysco | 11,519 | Code SY. The largest foodservice distributor in the country. It told customers to destroy the product and never said where it had already gone. |
| Subway | 8,075 | Code SUB. Quarter-inch shredded lettuce across fourteen lot codes, and the largest single restaurant chain in this recall. Subway has said nothing about this outbreak. |
| Markon | 7,459 | Code MARK. Not a restaurant but a purchasing cooperative, whose member distributors resell to independent operators who never see the name. A notice that reaches Markon is two steps from the kitchen. |
| Yum | 5,900 | The parent of Taco Bell. Four lot codes from two days of production, July 8 and July 11, the narrowest window of anybody in the file. |
| Jack in the Box | 5,130 | Code JB. Locations in Texas, Oklahoma and Louisiana, through the company’s Texas distribution center. It volunteered its own name to reporters on July 18. |
| Peak | 720 | Code PK. |
| Total | 236,192 | The sum of all twenty-one entries. FDA publishes the entries and does not add them up. |
Two things in that table deserve to be read twice. Subway is the biggest restaurant chain in this recall, bigger than Yum and bigger than Jack in the Box, and it has never said a word in public about this outbreak. Jack in the Box put its own name out voluntarily in July and became the chain everyone has heard about. The quiet one is the larger one.
And the recall was never only iceberg. FDA annotates every entry with what is actually in the bag. Iceberg alone is 167,504 cases. The other 68,688, twenty-nine percent of the recall, is lettuce and romaine blends at fifty-fifty and seventy-thirty and eighty-twenty, garden salad mixes with carrots and red cabbage, and salads carrying all four. Every federal page and every news story I have read says iceberg. Some of the people told to check their refrigerator for iceberg lettuce were holding a garden salad.
Beyond the customer list, one individual establishment has ever been named by a health department anywhere in this outbreak: the cafeteria at Cheshire Medical Center in Keene, New Hampshire. Nine customers and one cafeteria, against a product that went to thirty-one states.
The undercount, and the five reasons behind it
Every number above is a floor. CDC says so on its own page: the true number is likely higher because some people recover without medical care and are never tested for Cyclospora.
The standard estimate of that gap comes from Scallan and colleagues in Emerging Infectious Diseases in 2011, which puts the underdiagnosis multiplier for Cyclospora at 83.1. Applied to 19,595 confirmed cases, it puts the real number near 1,628,000. Here is why the multiplier is that large.
- The routine stool panel does not look for this parasite. A physician has to ask for it by name.
- The illness relapses over weeks, so people decide they have a stomach bug and never see a doctor at all.
- It takes about six weeks from a first symptom to a case landing in CDC’s count.
- Testing costs money. A nurse practitioner at a safety-net clinic in Lee County, Florida told a reporter in August that her clinic is not testing anyone, because her patients are uninsured and cannot afford it. The cases she has seen, in her own staff and her own patients, are in nobody’s count.
- Four states do not require the disease to be reported at all.
Where the 83.1 comes from, and the 99 percent that goes with it
The multiplier is not a guess. Scallan and colleagues built it as a chain, one link for every step an illness has to survive to become a counted case: the sick person seeks medical care, a stool specimen is submitted, the laboratory tests for that particular organism, and the test finds it. Each link was measured. Across three FoodNet population surveys run between 2000 and 2007, 35 percent of people with bloody diarrhea sought care and 36 percent gave a stool sample, against 18 and 19 percent for nonbloody diarrhea. Depending on the organism, between a quarter and all clinical laboratories routinely tested for it, and test sensitivity ran from 28 to 100 percent. Combined for this parasite those proportions produce 83.1, and nothing is stacked on top of it for underreporting, because the Cyclospora count came from active surveillance. 83.1 is the whole adjustment.
The second Scallan number is the one almost nobody quotes, and for a food safety argument it is the important one. The paper attributes 99 percent of domestically acquired cyclosporiasis to food. For the two other parasites people associate with contaminated water the figures are 8 percent for Cryptosporidium and 7 percent for Giardia. In the government’s own burden estimate this is a food problem and essentially nothing else. There is no swimming pool and no day care to fall back on. Somebody ate something.
Then there is the baseline. Scallan’s model began with 239 laboratory-confirmed Cyclospora illnesses a year in this country and put the total annual burden, counted and uncounted together, at 19,808, of which 11,407 were domestically acquired and foodborne. CDC’s laboratory-confirmed count for this one season is 19,595. What was confirmed in a single summer is very nearly what the standard estimate says the whole country suffers, diagnosed and undiagnosed, in an ordinary year.
Two people are dead and 1,043 people were hospitalized. The best-counted figure the federal government has, the one that took an entire summer to build, is about one percent of the people who probably got sick.
Recent Comments