The US Centres for Disease Control and Prevention declared the multistate Cyclospora outbreak linked to iceberg lettuce on 11 September, with a final count of 12,883 laboratory-confirmed illnesses across 21 states, 570 hospitalisations, and two deaths, both in Michigan. Illness onsets ran from 14 June to 17 August. Nothing in the American record approaches those numbers for this parasite, and the CDC notes that the true count is likely higher, since many people recover without seeking care or being tested.
The outbreak is closed as a public health event. The question it leaves open is regulatory in nature. The one federal rule designed to make an investigation like this faster, the Food Traceability Rule under Section 204 of the Food Safety Modernisation Act, was due to take effect on 20 January 2026, five months before the first person fell ill. Congress has barred the FDA from enforcing it until 20 July 2028.
How the outbreak unfolded
Traceback converged on a single supplier within a day of the investigation's announcement. The FDA and CDC first disclosed the multistate investigation on 16 July. On 17 July, the agencies announced that epidemiological and traceback data pointed to iceberg lettuce from Taylor Farms de Mexico, a processor based in central Mexico, and the company recalled all iceberg lettuce sourced from the region that day. The recalled product had been distributed to at least 31 states and sold to consumers in Mexico as well.
Most illnesses had already begun before the recall. The case count then climbed for two months as state and local health officials interviewed patients and added them to the outbreak, from under 2,000 in late July to 6,358 on 5 August, 10,930 by early September and 12,883 at closure, when Virginia became the 21st state. The outbreak accounts for roughly two in three of the 19,595 domestically acquired cyclosporiasis cases the CDC had recorded nationally by 8 September, against 1,180 for the same period a year earlier.
The FDA's own investigation continues. On-site inspections and sampling at the iceberg lettuce growers and the processing facility in Mexico have been completed, with samples awaiting analysis. How the lettuce became contaminated has not been established.
Why is this parasite different
Cyclospora cayetanensis is a microscopic parasite that the FDA says is believed to infect only humans and to spread through human faecal matter. That distinction matters for produce safety. Contamination cannot be traced to livestock or wildlife, the usual suspects in fresh produce outbreaks, which points instead to water sources or handling somewhere between field and packing line. The parasite's oocysts are also hardy. Washing does not reliably remove them from leafy surfaces, and standard chlorine sanitising in processing water does not kill them, which is why the industry's normal wash step provides little protection.
Symptoms typically begin about a week after exposure, ranging from two days to two weeks or more, and consist of prolonged watery diarrhoea that can relapse for weeks without treatment. Because the incubation period is long and the illness is often mild enough to go untested, outbreaks are typically recognised late and grow for a long time after the contaminated product has left the supply chain, which is precisely the pattern this one followed.
The rule that was supposed to be in force
Section 204 of the Food Safety Modernisation Act, passed in 2011, directed the FDA to identify the foods most often linked to foodborne illness and to require everyone handling them to keep standardised records. Leafy greens sit on that list. The rule requires each handler to assign a traceability lot code, record key data elements at defined critical tracking events such as harvest, cooling, packing, and shipping, and produce those records to the FDA within 24 hours of a request. The purpose is to compress the traceback from weeks of reconstructing paper trails to hours of querying linked records.
The rule's history is one of delay. Congress set a January 2013 deadline for the FDA to propose it. The agency missed it, the Centre for Food Safety sued, and a court-ordered schedule produced a final rule on 21 November 2022 with a compliance date of 20 January 2026. In March 2025, the FDA announced a 30-month extension to July 2028, citing the time needed by small retailers and the complexity of building linked records across more than a million facilities. In November 2025, the appropriations act that ended a government shutdown went further and barred the FDA from spending any funds to administer or enforce the rule before that date.
What the delay meant this summer
The traceback for this outbreak reached the supplier quickly, showing that the existing system can work when a single processor is involved. The problem lay downstream. A coalition of food safety groups wrote to congressional leaders on 12 August, pointing out that Taylor Farms' recall communications did not provide information the traceability rule would have required, and arguing that its earlier implementation would have enabled faster and more effective outbreak response. The Government Accountability Office had already recommended in a 2026 report that the FDA develop a plan with specific milestones for the product-tracing system intended to analyse traceability data.
On the day the outbreak closed, the FDA's Acting Deputy Commissioner for Food wrote to the produce industry about preventing the next one. The letter restated obligations already on the books rather than announcing new ones, which critics read as an acknowledgement that the agency's hands are tied on the rule it would otherwise be enforcing.
What it means for exporters to the US market
The compliance date has moved, and the rule itself stands unchanged. Any farm, packer, or processor that manufactures, processes, packs, or holds a food on the Food Traceability List for the US market will need to keep the records, assign lot codes, and be able to produce them within 24 hours, effective July 2028. That includes exporters outside the United States. For European operators, the requirement adds a layer on top of the traceability obligations already in force under EU food law, which require each business to identify its immediate suppliers and customers but do not prescribe the standardised data elements or the 24-hour response that the US rule demands.
The outbreak has also changed the politics of the delay. The largest Cyclospora event on record, in a food category the rule was specifically written to cover, occurred in the window between the original compliance date and the postponed one. Whether that shifts the July 2028 date is a question for Congress. For growers and packers selling into the US, the safer assumption is that the records will be required and that buyers may ask for them before the FDA does.
Sources
- CDC. (2026). Investigation update: Cyclospora outbreak, July 2026. Final update, 11 September 2026.
- FDA. (2026). Investigation of multistate outbreak of Cyclospora illnesses: iceberg lettuce (July 2026).
- FDA. (2026). Post-outbreak response activities: multistate outbreaks of Cyclospora illnesses.
- FDA. (2026). FSMA final rule on additional traceability record requirements for certain foods.
- Federal Register. (2025). Requirements for additional traceability records for certain foods: compliance date extension. 7 August 2025.
- Food Safety Magazine. (2026). Congress urged to prevent FDA traceability rule delay, which could have helped Cyclospora outbreak investigation. 14 August 2026.
- Food Safety News. (2026). CDC says Cyclospora outbreak linked to iceberg lettuce is over. 11 September 2026.
