Cyclospora and Iceberg Lettuce: What Operators Should Take From This Outbreak

Key highlights

• The cause: CDC and FDA linked a nine-state Cyclospora outbreak to shredded iceberg lettuce from a single farm in central Mexico.
• The recall: On July 17, Taylor Farms de Mexico recalled the product, reaching foodservice customers in 27 states across multiple restaurant brands.
• Impact: 1,947 reported cases and at least 98 hospitalizations, no deaths. Nationally, more than 4,100 laboratory-confirmed cases across 41 states.
• No positive sample: The recall rests on epidemiologic evidence. A July 18 positive was ruled a false positive the next day, and no product sample has confirmed positive.
• Safety limits: Sanitizer doesn't kill it, washing reduces without eliminating, freezing does nothing, and cooking requires reaching 158°F, above standard minimums.
• The core problem: Affected and unaffected locations belonged to the same chain. Telling them apart came down entirely to accurate supply records, underscoring the importance of digital systems that centralize receiving, traceability, and food safety documentation.

What happened

CDC and FDA have linked a multistate Cyclospora outbreak to shredded iceberg lettuce served at restaurant locations in nine states. On July 17, 2026, Taylor Farms de Mexico voluntarily recalled all iceberg lettuce sourced from central Mexico. Recalled product had been distributed between June 29 and July 16 to foodservice customers in 27 states and retail stores in at least 15.

The affected states are Indiana, Kentucky, Michigan, Ohio, West Virginia, Illinois, Kansas, Oklahoma, and Pennsylvania. According to the CDC investigation update, 1,947 people infected with Cyclospora who reported eating at locations of a national restaurant chain have now been identified across those nine states, with at least 98 hospitalizations and no deaths. Illness onsets run from June 22 through July 20, 2026.

The evidence came from interviews. Michigan's health department reviewed food exposure details from 190 people who had eaten at those locations, and 90 percent reported eating iceberg lettuce. FDA's traceback then converged on a single supplier of shredded iceberg lettuce from central Mexico.

FDA has since attributed the contamination to one independent farm, which Taylor Farms describes as representing less than one percent of the U.S. iceberg lettuce supply. That's worth sitting with: a single grower, in a single region, produced enough contaminated product to sicken thousands of people across nine states.

Worth noting for context: the chain pulled fresh produce from restaurants in the affected states on July 9, roughly a week before CDC publicly linked the outbreak to lettuce. The contamination started upstream, and the restaurants receiving that product were simply downstream of it.

It didn't stop at one brand. Recalled lettuce also reached locations of a second national restaurant chain across three southern states, and Walmart pulled four Marketside bagged salad products from stores across 27 states. One supplier's product moved through multiple operators, retailers, and distribution channels before anyone knew there was a problem.

Outbreak statistics at a glance

1,947 cases · 9 states · 98+ hospitalizations · 0 deaths · 27 states received recalled foodservice product

Source: CDC and FDA, as of July 24, 2026

The numbers are messier than they look

Several sets of figures are circulating, and they measure different things.

The linked outbreak is the nine-state cluster: 1,947 cases, at least 98 hospitalizations, no deaths.

National surveillance paints a much broader picture. CDC reports 4,173 laboratory-confirmed domestically acquired cases across 41 states for May 1 through July 20, with 308 hospitalizations and no deaths, plus more than 7,400 additional reports not yet laboratory confirmed, bringing the working total to roughly 11,500. For comparison, only 249 cases had been reported by the same point in 2025.

State counts run higher still. Michigan reported 8,176 cases as of July 24, with 160 hospitalizations. Northwest Ohio reported 2,508 regional cases. States count probable and confirmed cases together; CDC counts only laboratory-confirmed ones.

And this isn't the only outbreak. FDA has been investigating several separate cyclosporiasis clusters this season. On July 24 it announced another one tied to a product not yet identified, and North Carolina is investigating more than 560 cases potentially linked to parsley, cilantro, and lettuce. The lettuce outbreak is the largest of the bunch, not the whole picture.

Reading the numbers correctly

Don't add these together. They overlap, use different case definitions, and update on different schedules. Whenever you cite a count, name the source and the date, since all of these have moved daily.

What Cyclosporiasis looks like

Knowing the symptom pattern matters for two reasons: it helps you recognize a possible cluster among staff or guests, and it explains why case counts lag reality by weeks.

Cyclospora infection, known as cyclosporiasis, typically causes watery diarrhea, loss of appetite, weight loss, bloating, nausea, stomach cramps, and fatigue. Some people also run a low-grade fever.

Three features set Cyclosporiasis apart:

1. Slow onset. Symptoms usually begin about a week after exposure, with a documented range of 2 to 14 days. By the time someone feels sick, the meal is long forgotten.

2. It comes back. Left untreated, cyclosporiasis often follows a remitting-relapsing pattern that can last a month or more. Someone who felt better and then got sick again may never connect it to a single meal.

3. It's treatable. Antibiotic treatment works well, which is one reason hospitalization rates have stayed comparatively low even as case counts climb.

One practical note for anyone whose staff report these symptoms: routine stool testing can miss the parasite. CDC has advised clinicians to request Cyclospora testing specifically, which is part of why the true case count runs well above the confirmed one.

The detail every multi-unit operator should sit with

One sentence in the CDC update carries more operational weight than anything else in this story:

"Not all locations in these states received shredded iceberg lettuce from the same supplier."

Within a single brand, in a single set of states, some locations received the implicated product and some didn't. The difference wasn't visible from the menu, the region, or the sign on the building. It lived in the supply records.

That's the case for lot-level traceability, demonstrated in public. When a traceback lands, operators who can map supplier and lot to specific locations respond precisely. Everyone else pulls more product than necessary or misses affected product entirely.

And with recalled product reaching foodservice customers in 27 states and more than one restaurant brand, this was never a question confined to one operator. Any kitchen buying shredded iceberg or salad mixes containing iceberg in that window needed the same answer.

The question this outbreak asked

Which of our locations received product from that supplier, in which lots, and where did it go?

That has one of two answers: a lookup that takes minutes, or a phone call to every store. The difference was decided months earlier, at the receiving door.

A recall built on epidemiology, not a lab result

Here's a detail worth understanding, because it cuts against how most operators assume recalls work.

On July 18, FDA reported that a sample of shredded iceberg lettuce had tested positive for Cyclospora. The sample came from routine import surveillance, not from recalled product. The following day, FDA laboratory experts re-reviewed the result and concluded it didn't represent true amplification. They declared it a false positive and removed it from the record. As of July 19, FDA states there are no confirmed positive product sample results for Cyclospora in this investigation.

The recall didn't move. FDA called the epidemiologic evidence overwhelming and its guidance unchanged. Mexican health authorities separately reported that lettuce and water samples from the supplier's facility tested negative, which doesn't contradict the traceback, since the implicated crop had shipped weeks earlier.

Two takeaways for an operator.

Waiting for lab confirmation is waiting for something that may never come. Cyclospora is notoriously difficult to detect in food, which is exactly why the false positive happened and why negatives prove little. If your internal policy is to hold action on a supplier notice until a product test confirms it, that policy will fail you.

A recall can be entirely valid without a positive sample. Epidemiologic and traceback evidence is evidence. Treat a recall notice as the trigger, not as a preliminary finding awaiting confirmation.

Why normal kitchen controls fall short

Cyclospora cayetanensis is a microscopic parasite that contaminates food or water. It doesn't spread easily person to person, because oocysts need one to two weeks in the environment before becoming infectious. That's unusual, and it means the contamination arrives on the produce rather than from a food handler.

Three properties make it difficult for kitchens.

Sanitizer isn't a reliable control. In its Health Advisory, CDC states that Cyclospora is unlikely to be killed or inactivated by routine chemical disinfection, and that no EPA-registered disinfectant products have been shown effective against it. That guidance concerns surface disinfection. For produce specifically, CDC advises that chemically disinfecting or sanitizing produce might not fully eliminate Cyclospora, and that produce should be washed thoroughly even when labeled pre-washed. Chlorine, the active ingredient in most produce washes, isn't effective against it.

Washing helps but doesn't solve it. Rinsing under clean running water physically removes some oocysts and remains the recommended baseline. It's risk reduction, not elimination.

Freezing does nothing. Cold holding slows bacterial growth, but it doesn't inactivate this parasite.

The temperature number, and the trap inside it

Heat does work. FDA guidance indicates that heating produce to at least 158°F (70°C) is expected to inactivate the parasite.

Here's the part that catches people out. 158°F sits above most of the minimum internal cooking temperatures your kitchen already works to.

Don't assume "we cook it" resolves the risk. A sautéed vegetable held at 135°F hasn't reached 158°F. Neither has a whole cut finished at 145°F. Only items taken to 165°F reliably clear it, and produce added after cooking hasn't been heated at all.

Where the exposure sits on a menu

Risk concentrates in produce served raw or added after the cook step.

Past U.S. outbreaks have been linked to produce including raspberries, basil, cilantro, snow peas, and lettuce, according to FDA. The clusters under investigation this season involve several of those same commodities, a reminder that the category matters more than any single implicated product.

Most of these items also sit on the FDA's Food Traceability List, which means lot-level records on them are a legal requirement under FSMA 204. Fresh leafy greens, fresh herbs, melons, tomatoes, cucumbers, peppers, sprouts, fresh-cut fruits and vegetables, and refrigerated ready-to-eat deli salads are all on the list. Whole berries and whole snow peas are not.

Six things worth doing

1. Check the recall against your inventory and your distributor. The recall covers shredded iceberg lettuce and salad mixes containing iceberg, sourced from central Mexico and distributed between June 29 and July 16. Foodservice customers in 27 states received product, across more than one brand. Confirm directly with your supplier rather than assuming you're unaffected.

2. Determine which of your locations received what. Supplier and lot, mapped to sites. If you can't answer that today, that's the finding.

3. Capture lot codes at receiving, starting now. The habit that turns the next traceback into a lookup.

4. Stop treating your produce wash as a kill step. Keep washing thoroughly, including pre-washed product, and be clear with your team about what it actually does.

5. Reconsider raw produce items for the rest of the season. CDC identifies May through August as the cyclosporiasis season. The calculation looks different for healthcare, senior living, and K-12 accounts.

6. Watch the primary sources. The CDC outbreak page and the FDA outbreak advisory lead the general press, and both have been updated repeatedly. FDA has noted additional states may be added.

One more reason records matter

Litigation follows outbreaks. Federal lawsuits began within days of the recall. One of the first, filed on July 17 in the Eastern District of Michigan, named both a restaurant company and the lettuce supplier, and plaintiffs' firms have said they represent many more claimants.

That's not a reason for alarm, but it is a reason for records. In the aftermath of any outbreak, an operator's ability to show what was received, when it was pulled, and how the response was executed becomes the difference between a documented good-faith response and a version of events pieced together from memory. The same lot-level records that make a recall response fast are the ones that make it defensible.

The lesson underneath the news

Strip away the parasite and the brand, and this is a case study in what protects a multi-unit operator when the problem starts upstream.

The controls a kitchen usually leans on didn't apply here. Sanitizer doesn't kill this organism. Washing reduces without eliminating. Freezing does nothing. Cooking works, but only above a threshold higher than most items reach, and the implicated product was served cold. Employee health policy isn't the lever, because this parasite doesn't travel that way.

What was left was knowing what you received, from whom, and where it went. Some locations had the implicated product and some didn't, and telling them apart was a records question. Operators building traceability now for FSMA 204 are finding it pays off in weeks like this one.

Consistent lot and date capture through BOHA! Labeling, and standardized multi-site response through BOHA! Checklist, are what let that capability run the same way across a hundred kitchens on the same afternoon.

Frequently asked questions

What is Cyclospora?

Cyclospora cayetanensis is a microscopic, single-celled parasite that causes an intestinal illness called cyclosporiasis. People become infected by consuming food or water contaminated with the parasite. It's too small to see without a microscope.

What are the symptoms of cyclosporiasis?

Watery diarrhea, loss of appetite, weight loss, bloating, nausea, stomach cramps, and fatigue, sometimes with a low-grade fever. Symptoms usually begin about a week after exposure, and untreated illness can follow a relapsing pattern lasting a month or more. It's treatable with antibiotics.

What foods commonly carry Cyclospora?

Fresh produce is the usual source. Past U.S. outbreaks have been linked to raspberries, basil, cilantro, snow peas, mesclun and leafy greens, and now shredded iceberg lettuce. The parasite is most often associated with produce eaten raw.

What caused the 2026 Cyclospora outbreak?

CDC and FDA linked a multistate outbreak to shredded iceberg lettuce served at restaurant locations in nine states. FDA traceback identified a single independent farm in central Mexico, and Taylor Farms de Mexico recalled all iceberg lettuce sourced from that region on July 17, 2026.

How many people got sick in the iceberg lettuce outbreak?

CDC reported 1,947 people infected with Cyclospora across nine states, with at least 98 hospitalizations and no deaths. Illness onsets ran from June 22 through July 20, 2026.

How many Cyclospora cases are there nationally in 2026?

CDC has reported 4,173 laboratory-confirmed domestically acquired cases across 41 states from May 1 through July 20, with 308 hospitalizations and no deaths, plus more than 7,400 additional reports not yet confirmed. State counts run higher because states may include probable cases.

Which states are affected?

The linked outbreak covers Indiana, Kentucky, Michigan, Ohio, West Virginia, Illinois, Kansas, Oklahoma, and Pennsylvania. Recalled product was distributed far more widely, to foodservice customers in 27 states and retail stores in at least 15.

Which products were recalled?

Shredded iceberg lettuce and salad mixes containing iceberg lettuce sourced from central Mexico, distributed between June 29 and July 16, 2026, including Marketside-brand retail product. Recalled product reached foodservice customers in 27 states. See the recall notice for the complete list.

Did any lettuce test positive for Cyclospora?

No. A sample reported positive on July 18, 2026 was re-reviewed by FDA laboratory experts and declared a false positive the following day. As of July 19, FDA reports no confirmed positive product sample results. The recall and the outbreak link rest on epidemiologic and traceback evidence.

Does washing produce kill Cyclospora?

No. Washing under clean running water removes some oocysts and is recommended, but CDC advises that chemically disinfecting or sanitizing produce might not fully eliminate the parasite, and that produce should be washed even when labeled pre-washed.

Does cooking kill Cyclospora?

Yes, above a specific threshold. FDA guidance indicates heating produce to at least 158°F (70°C) is expected to inactivate the parasite. Because that sits above the 135°F, 145°F, and 155°F minimums used for many foods, cooking doesn't automatically mean the threshold was reached. Freezing does not inactivate it.

Is Cyclospora contagious?

Not directly between people. Oocysts shed in stool need one to two weeks in the environment before they become infectious, so person-to-person transmission is unlikely. Infection comes from contaminated food or water.

Is the outbreak over?

No. As of July 24, 2026 the CDC and FDA investigation remains open, additional states have been added, and FDA is investigating other cyclosporiasis clusters unrelated to this one.