The Largest U.S. Cyclospora Outbreak on Record Just Hit Nine States. It Is a Live Test of Food Traceability.

The largest known cyclosporiasis outbreak in U.S. history expanded to nine states on Friday, and for food and beverage operators it is arriving at a moment of unusual regulatory ambiguity around the exact capability the situation demands: knowing where produce came from, fast.

The Centers for Disease Control and Prevention added Illinois, Kansas, Oklahoma, and Pennsylvania to an outbreak that already included Indiana, Kentucky, Michigan, Ohio, and West Virginia, according to an agency update posted Friday and first reported by the Washington Post (Washington Post, July 24, 2026).

In its July 24 investigation update, CDC reported 1,947 laboratory-confirmed infections linked to the multistate outbreak, with at least 98 hospitalizations and no deaths. Illnesses began June 22 and onset dates have continued through July 20 (CDC Investigation Update, July 24, 2026).

CDC also notes in that same update that the true number of sick people is likely higher than the reported figure, because some people recover without medical care and are never tested, and because it can take as long as six weeks to determine whether a case is part of a cyclospora outbreak. CNN reported that health departments across the nine affected states have logged more than 12,000 cyclosporiasis cases this summer, with the majority in Michigan (CNN, July 24, 2026).

What the traceback found

Epidemiologic and traceback data show that iceberg lettuce sourced from central Mexico was the vehicle, according to both CDC and FDA investigation updates. FDA reported that on July 17, 2026, Taylor Farms de Mexico announced it was voluntarily removing all iceberg lettuce sourced from central Mexico from the U.S. market and initiated a recall (FDA Outbreak Investigation, July 2026).

The recall scope illustrates how far a single produce lot travels in a modern supply chain. CDC's outbreak page states that recalled lettuce was distributed and sold in at least 27 states to consumers, restaurants, and retailers (CDC, July 2026). FDA's investigation page details the recall as including Marketside-brand product available at Walmart described as Iceberg Salad in 12-ounce and 24-ounce sizes and Shredded Lettuce in 8-ounce and 16-ounce sizes, with Best If Used By dates spanning July 18 to August 3, 2026, alongside a separate list of products distributed to foodservice customers (FDA, July 2026).

The investigation also demonstrates why produce traceback is difficult. CNBC reported that Mexican health authorities said Thursday that samples of lettuce and water from the facility tested negative for cyclospora, and noted that a negative result does not disprove FDA's earlier identification of the source, given that the crop responsible would have been distributed weeks earlier and cyclospora carries a long incubation period (CNBC, July 24, 2026).

The traceability question facing every food business right now

The regulatory framework built specifically to compress this timeline is FSMA Section 204, the FDA Food Traceability Rule. Fresh leafy greens, including fresh-cut, sit at the top of the Food Traceability List that the rule covers.

Under the rule, covered entities must capture Key Data Elements at seven Critical Tracking Events, harvesting, cooling, initial packing, first land-based receiving, shipping, receiving, and transformation, and must produce those records for FDA in an electronic, sortable format within 24 hours of a request, according to compliance guidance published by Inecta (Inecta, May 2026).

The original compliance deadline was January 20, 2026. According to regulatory tracking published by Croptracker, subsequent legislation paused enforcement of FSMA 204 until 2028 and directed FDA to work directly with industry on developing operationally sound approaches for achieving lot-level traceability, with no changes to the final rule itself announced as of early 2026 (Croptracker, 2026).

That leaves food businesses in a genuinely difficult position. The requirements are on the books. Enforcement is deferred. And an outbreak spanning 27 states of distribution is unfolding in the interim.

What food and beverage operators should be doing this week

Three practical priorities emerge for restaurant groups, retailers, distributors, and foodservice operators.

• Confirm lot-level visibility on Food Traceability List commodities. Per FDA's recall notice, the affected product spans both retail packaging and foodservice distribution. Any operator sourcing fresh-cut leafy greens should be able to identify affected lots, receiving locations, and downstream disposition without a manual reconciliation exercise. If that takes more than 24 hours, that is the gap the traceability rule was written to close, regardless of the enforcement timeline.
• Revisit sourcing concentration on single-origin produce. The recall covered iceberg lettuce sourced from one growing region, per FDA. Procurement teams with concentrated sourcing in a single region on any Food Traceability List commodity face the same category of continuity exposure, independent of any individual supplier's practices. Regional diversification is a supply resilience question as much as a food safety one.
• Pressure-test the 24-hour record request. Industry analysis published by PDP Spectra found that many growers, processors, and distributors discovered during FSMA 204 preparation that their existing ERP, WMS, and barcode systems could not produce a clean traceability record without substantial data engineering work (PDP Spectra, May 2026). Running that request as an internal drill, before a regulator or a customer asks, is the cheapest way to find the gaps.

CDC guidance notes that washing alone cannot guarantee removal of cyclospora from produce, though cooking to at least 158 degrees Fahrenheit will kill the parasite. For fresh-cut ready-to-eat categories, that removes the final intervention step from the process, which is precisely why upstream traceability carries so much weight in these commodities.

FDA's investigation is ongoing. CDC has said it is publishing weekly surveillance updates through 2026 due to elevated case volumes compared to the same period in 2025. For food and beverage operators, the more durable takeaway is not about one commodity or one growing region. It is that the speed of a traceback has become a measurable operational capability, and the industry is being asked to demonstrate it in real time.