The Cyclospora Outbreak Is Over. The Gaps It Exposed Are Not.
The FDA has closed its cyclospora investigation, but communication breakdowns, a delayed safety rule, and other holes in the safety system leave open questions for next year.
Last Friday, the Food and Drug Administration closed its investigation into this summer’s massive outbreak of cyclosporiasis. It was the largest such incident in U.S. history, with federal authorities eventually linking 12,883 illnesses, 570 hospitalizations, and two deaths to shredded iceberg lettuce supplied by Taylor Farms—a staggering toll for a parasite most Americans had never heard of.
The recall showed how far Taylor Farms’ lettuce traveled, from Taco Bell kitchens, to bags labeled with Walmart’s house brand, to the trucks of Sysco, the nation’s largest food distributor.
In announcing the closure of its investigation, the FDA said its inspectors in central Mexico found the parasite in a wastewater tank at a facility where the lettuce was processed and in a drainage ditch of a farm where it was grown. The agency is still analyzing whether the samples are genetically related to this summer’s infections.
A Taylor Farms spokesperson said the company will “indefinitely suspend” sales of iceberg lettuce from central Mexico during the region’s rainy season, which is when cyclospora infections in the U.S. typically spike.
The FDA said it plans to publish a report on what went wrong and how to prevent a repeat before next year’s growing season. That timeline leaves little room to spare. Cyclosporiasis cases typically climb in late spring and peak in summer—though this year’s were an order of magnitude greater than usual—giving the FDA and the Centers for Disease Control and Prevention only months to apply what they learned.
“There’s a fair amount of additional work that needs to come together to really give us a more complete picture of what happened this year and how best to approach next year,” says Craig Hedberg, PhD, a professor at the University of Minnesota who studies how to make foodborne illness outbreak investigations more effective.
Here are four key takeaways from the outbreak:
Taylor Farms made it hard for consumers to understand its recall
The lettuce eventually linked to over 12,000 infections reached the U.S. earlier this year, when it was served at Taco Bell locations. In late June, Taylor Farms also began shipping it to retailers, restaurants, and distributors in at least 31 states, and kept shipping for weeks. By July, federal authorities had tied a Mexican facility to the outbreak. Yet consumers still couldn’t find out what precisely was contaminated, where it went, and how worried they should be.
The confusion started with the recall itself. Published on a Friday afternoon in mid-July, Taylor Farms’ initial notice did not include the word “recall” and named no products. Within 18 hours, the company corrected that—sort of. Its updated notice promised a “complete list of affected products, lot codes, and use-by dates and instructions for returning or disposing of them.” But the 30-odd products were listed in internal shorthand, with abbreviations in place of consumer-facing product names and no indication of where they were sold. Shredded iceberg lettuce served at Jack in the Box locations was listed as “JB 1/8″ SHRED LETTUCE 4/5#,” and a prechopped salad mix sold at Walmart stores under house brand Marketside was “MKTSD Iceberg Salad 12 oz, 24 oz.”
If consumers can’t understand a recall notice, it can’t protect them. In the hours after the notice was published, Consumer Reports was able to decode some of these listings by contacting companies with similar-sounding brand names. Only Taco Bell, Walmart, Sysco, and Jack in the Box acknowledged receiving the recalled lettuce. The other recipients—including Subway, produce distributor Cross Valley Farms, supplier Markon, and wholesaler Peak Fresh Produce—did not respond to our inquiries and were not officially linked to the outbreak until they were named in an FDA enforcement report weeks later.
A Taylor Farms spokesperson said its notice identified the products using the “codes most pertinent to food service, who need the information in this format in order to pull product,” and that the “vast majority of product was not sold in retail stores.”
The FDA and CDC left the public guessing, too
The day after Taylor Farms published its notice, the FDA announced that a sample of the company’s iceberg lettuce from outside the recall had tested positive for cyclospora. This was significant because it suggested the recall was likely to grow—but the FDA retracted the result as a false positive the next day.
Many took that to mean that Taylor Farms’ lettuce was cleared. But that wasn’t the case. The FDA had to clarify at a press conference that the retraction didn’t cast doubt on the previously established link between the recalled lettuce and the cyclosporiasis outbreak.
(A series of since-deleted social media posts made by Taylor Farms, one of which said the FDA had apologized to the company—a claim the FDA denied—further fanned the confusion.)
The agency’s problems went deeper than any single announcement, says Brian Ronholm, CR’s director of food policy, who previously served as the deputy under secretary of food safety at the U.S. Department of Agriculture. The FDA and CDC struggled to coordinate their public messaging, he says, and were slow to release key data and provide updates about the investigation. After the recall, the agencies generally posted new figures weekly, while several states released updated counts daily. Despite the slower pace, their joint updates sometimes didn’t align. In late July, when both agencies published statements announcing that the outbreak had expanded, the FDA’s included a map showing that the recalled lettuce had been distributed to New York—which had not previously been listed as receiving the lettuce—while the CDC’s did not.
Shortly after CR asked about the discrepancy, New York quietly disappeared from the FDA’s map. “The map has been updated,” a spokesperson wrote that evening. “Thanks for letting us know.”
A long-delayed rule probably would have kept some people from getting sick
Investigators hit a snag at exactly the step a long-delayed federal rule was designed to speed up: finding out where a restaurant chain’s lettuce came from.
Taco Bell was one of the outbreak’s earliest signals. On July 1, Michigan’s health department asked Taco Bell’s parent, Yum Brands, for supply chain records, according to emails obtained through public records requests filed by the New York Times and Bloomberg News. It asked again on July 3 and a third time three days later, when some of the records arrived. The FDA also requested more information on July 8, but didn’t get the relevant records until July 13. Four days later, Taylor Farms published its recall notice, which said “FDA traceback is indicating a specific independent farm... as the potential source of the outbreak.”
The Food Safety Modernization Act of 2011 anticipated this problem. A provision known as the traceability rule requires companies handling high-risk foods like leafy greens, fresh-cut fruits, and raw cheese to keep detailed records of how those foods move through the supply chain and hand them over within 24 hours of an FDA request. The FDA itself has said the rule would allow for “faster identification and removal of potentially contaminated food from the market, resulting in fewer foodborne illnesses and deaths.”
The rule was supposed to take effect in January 2026, 15 years after the law ordering its existence was signed. But in March 2025, the FDA pushed that deadline back two and a half years to July 2028, in order, it said, to give companies more time to comply. Congress later codified the delay. That means the rule won’t be in force next summer, either.
“Had the rule been in place, it would have made it easier to trace the outbreak back to the source more quickly,” says Ronholm, who added that FMI, a trade group that represents the consumer food supply chain, lobbied Congress to delay the rule’s implementation. “Basically, Congress decided to put consumers at risk because a small part of the food industry claimed 15 years wasn’t enough time to prepare.”
The FDA’s plan to protect consumers from the next outbreak is lacking
Last week, the FDA published an overview of the 10 actions it plans to take before the next growing season to reduce the risk of another cyclosporiasis outbreak. The list includes sensible measures, like working with Mexican agencies to help educate the produce industry on cyclospora prevention, stepping up surveillance of high-risk foods, and working with the CDC to create a “single, replicable standard” for genotyping cyclospora “to make it faster and easier to trace outbreaks back to their source.”
But most of the actions listed are activities the FDA was already doing—and none appear designed to address the specific failures revealed by this outbreak, much less the deeper issues that have long plagued the agency, like budget cuts, a chronically understaffed investigations arm, and the loss of key monitoring programs.
“The FDA’s action plan announcement was a subtle admission that there’s a critical need for the agency to modify and refine its outbreak and investigation protocols,” says Ronholm. “What would really make a difference is assertive leadership that translates into an aggressive approach to investigations, ensuring that outbreak sources are identified more quickly, the industry is held accountable, and information is communicated to consumers with greater clarity.”
