Cyclospora 2026: The Outbreak That Tested Negative in Produce

The outbreak

On 22 June 2026, someone in the American Midwest developed watery diarrhoea that would not resolve; by 27 August, the CDC and FDA had counted 11,458 confirmed illnesses across 20 states, 495 hospitalisations, and two deaths, all traced to shredded iceberg lettuce grown in central Mexico and processed by Taylor Farms de Mexico [1]. The recall came on 17 July — four weeks before the last recorded illness onset [2].
 
The number that matters to us, though, is not 11,458. It is zero. The FDA obtained no confirmed positive Cyclospora product sample from the implicated lettuce; one early presumptive positive turned out to be a false positive. The supplier was identified by traceback convergence and by interviews in which 90 per cent of Michigan cases reported eating iceberg lettuce [2].
 
An outbreak of eleven thousand people, resolved without ever finding the parasite in the food. If your food safety management system answers a parasite hazard in leafy greens with “we do product testing,” this outbreak has just told you — at considerable human cost — that your verification programme would not have caught it either.
 
Why The Organism Breaks Our Assumptions
Most of our hazard logic was built against bacteria. Bacteria grow where time and temperature control means something. Bacteria are killed by defined thermal processes and, usefully, by sanitizers. Bacteria can be cultured, so a laboratory can tell you whether they are there.
 
Cyclospora cayetanensis is a coccidian protozoan parasite, and almost none of that holds, which does not grow in food. It cannot multiply outside a human host, so every control premised on preventing growth is irrelevant to it. The dose that lands on the leaf is the dose the consumer eats.
 
Cyclospora arrives already committed, where oocysts shed in human faeces are not infectious when shed. They must sporulate in the external environment first, a process the CDC puts at one to two weeks in favourable conditions [3]. The implication is the important part: the contamination event necessarily happened a fortnight or more before the product could make anyone ill. Not in your plant, on your production day — upstream, in the growing environment, long before the product reached your HACCP plan.
 
Cyclospora is a human organism, which has no meaningful animal reservoir. Contamination of produce therefore means contamination with human faecal material: sewage-contaminated surface water, combined sewer overflow, inadequate field sanitation, septic run-off [4]. These outbreaks originate as sanitation and water-infrastructure failures, and reach consumers as food safety events.
 
The CDC formally designates 1 May to 31 August as the cyclosporiasis season [5], and the outbreak sits squarely inside it. That is actionable: a risk-based verification programme should intensify in that window rather than run flat across the year, meaning it is seasonal.
 
Cooking to 70 °C works [1] for the contaminated produce, but for ready-to-eat salad, that control does not exist as it has no kill step in the application.
 
The Testing Problem

There are two detection failures there, and both were on display, where Cyclospora is routinely missed clinically. CDC guidance is explicit that clinicians must specifically request Cyclospora testing, because routine ova-and-parasite examination may not reliably detect it [5]. Even with the right test ordered, symptomatic patients may not shed enough oocysts to be detected, and a single negative stool specimen does not exclude the diagnosis [3], whereas reported cases are therefore a systematic undercount, and the CDC says so in terms [1].
 
In food, the problem is worse as detection of the parasite is not a matter of sending a sample for “micro.” The FDA maintains a dedicated method — BAM Chapter 19b, real-time PCR — precisely because conventional microbiological and microscopic approaches are inadequate. The December 2024 edition replaced the previous 18S rRNA target with a more specific Mit1C mitochondrial target, and its published validated matrices include romaine lettuce and shredded cabbage [6]. The method is sound, which has been independently verified and deployed in produce survey work by the Canadian Food Inspection Agency [7].
 
Consider what matrix validation means, where oocyst recovery depends on leaf surface, on wash and concentration chemistry, and on the PCR inhibitors a particular commodity carries. Thus, validation does not transfer freely between commodities. Hence, a supplier sends you a certificate reading “Cyclospora not detected,” the questions are: by which method, on which matrix, validated to what limit of detection, on what sample mass? Against sparse, faecal contamination measured in a handful of oocysts per kilogram, a negative result on a 25-gram grab sample carries almost no information.
 
The FDA, with its full laboratory network and with onsite inspections and sampling at growers and processors in Mexico, did not obtain a confirmed positive [2]. Eleven thousand people were made ill by product that tested clean, where definitive evidence sits, but not detected in the outbreak.
 
Nor will the wash step save you, whereas Chlorinated flume water in leafy green processing exists mainly to stop one contaminated head from contaminating the batch. Cyclospora oocysts have a robust wall and resist the chlorine concentrations and contact times used in produce washing. What washing offers is partial physical removal, not inactivation, and it cannot be validated to any meaningful log reduction.
 
One further point about the particular product is that it was shredded. Size reduction and mixing take contamination that may have been confined to a few heads from a single block and distribute it across a far larger volume and a far larger number of consumers. Shredding creates no hazard, but it powerfully amplifies exposure, and it destroys the one-to-one relationship between incoming unit and finished lot that makes traceback tractable. In a hazard analysis, that step deserves naming as hazard-amplifying.
 
The Public Net Has Holes

There are two major events that go hand in hand with the outbreak. Effective 1 July 2025, the CDC's FoodNet reduced mandatory active surveillance from eight pathogens to two as the first event. Only Salmonella and Shiga toxin-producing E. coli remain required; Campylobacter, Cyclospora, Listeria monocytogenes, Shigella, Vibrio, and Yersinia became optional, as cited by CDC funding [8]. FoodNet is the only system that actively monitors multiple foodborne diseases at the federal level, whereas others wait for states to notify, and active surveillance is what lets you distinguish “there are more cases” from “more cases are being reported.” Frank Yiannas, the former FDA Deputy Commissioner for Food Policy and Response, put the consequence in one sentence: “Without the broader data, we won't know as accurately as possible whether we're getting better or worse” [9].
 
Fourteen months later, the organism that came off the mandatory list produced one of the largest outbreaks in its recorded history. A surveillance change did not contaminate a field in Guanajuato, but the CDC's own July 2026 health advisory reported 1,645 confirmed domestic cases against 249 in the same period of 2025 [5], and a signal that size is one you want to see early.
 
The second major event is that the implicated facility had not been inspected by the FDA since 2019. The inspection before that was in 2013, in the course of investigating a different cyclosporiasis outbreak. Against a congressional mandate of 19,200 foreign inspections a year, and the FDA's own internal target of 4,700, the agency conducted roughly 1,000 in 2025, which was a 29 per cent decline on 2024. Of some 47,000 foreign food manufacturers supplying around 90 per cent of non-meat food imports, 4.5 per cent have been inspected since 2023 [10]. For scale on the outcome, the FDA investigated at least 33 multistate outbreaks in 2025 and closed 20 with a source identified, leaving 13 unresolved [11].
 
Hence, the operational conclusion is not a political one, whereas if your supplier assurance rests on an unstated assumption that a regulator periodically visits your overseas suppliers and would find serious problems, the numbers do not support it. You cannot substitute for public oversight, but you can stop assuming it is there.
 
What Food Safety Actually Requires

Here is where the news becomes a conformity question, and if you consider food safety references to act on it, the following clause references below are from ISO 22000:2018 [12].
 
Clause 8.5.1.2 requires raw material characteristics, including origin. For a raw agricultural commodity, origin is not a formality, which is the single most predictive risk variable you hold. “Iceberg lettuce, supplier X” is not an adequate hazard analysis input for a commodity whose hazard is geographically and seasonally structured.
 
Clause 8.5.2 requires identification of all hazards reasonably expected to occur, and the standard's definition of a biological hazard covers parasites, not only bacteria and viruses. Produce hazard analyses commonly list Salmonella, E. coli O157:H7, and Listeria monocytogenes and stop there. After 2026, a hazard analysis for imported leafy greens that does not name Cyclospora cayetanensis is hard to defend as complete. The evidence base is public, the seasonality is published, and the source regions are documented.
 
Clause 8.5.2.4 is the decisive one. You must assess control measures against their ability to achieve the acceptable level. An honest assessment here reaches an uncomfortable conclusion: there is no control measure available at the processing site capable of reducing such hazard to an acceptable level. Washing cannot be validated as inactivation, as there is no thermal or chemical step they can prevent, eliminate, or reduce. Product testing cannot provide assurance against sparse, focal contamination, such as the FDA's own zero-positive result demonstrates.
 
The control measure is therefore upstream, and it is supplier control, which is not a gap in the standard; it is the standard telling you where to put your effort. But it does mean supplier approval cannot remain an administrative activity run by procurement, which is a food safety control measure, and under Clause 7.1.6 its criteria must reach past the processor's certificate into the agricultural conditions: water source and treatment, field sanitation for workers, adjacent land use, sewage infrastructure in the catchment, and the grower's own agricultural water assessment. The example given uses ISO 22000, but the rest of the private or public food safety systems all recommend similar activities. Further, under the FSMA pre-harvest agricultural water rule must evaluate the water system, water practices, crop characteristics, and adjacent land use must be evaluated, and same-season mitigation must be triggered where untreated human waste is implicated [13].
 
Clause 8.8 requires verification that control measures are effective, not merely that they were performed. Collecting a certificate and a COA verifies documentation, not effectiveness.
 
Clause 8.4.2 has a specific scenario to rehearse here, where organisations rehearse recalls triggered by a positive result. Very few rehearse the harder case: a regulator telling you that traceback has converged on your product while every test you hold is negative. Considering the current outbreak: first onset 22 June, recall 17 July, last onset 15 August. Your recall will not stop the illnesses already moving through the incubation and reporting pipeline.
 
For FSSC 22000 certified sites, the Version 6 additional requirements on management of services and on food safety and quality culture engage directly, as does the obligation to notify the certification body of serious events [14]. Version 7 was published in May 2026 with a 12-month transition period, so plan the two pieces of work together [15].
 
HACCP Review

Name the parasite: Review every hazard analysis covering fresh produce, especially imported leafy greens, herbs and berries. If the biological hazards listed are all bacteria, it is incomplete.
 
Push supplier criteria into the field: Growing region and block-level traceability, water source and treatment, the grower's agricultural water assessment and its mitigations, field sanitation provision, adjacent land use. A supplier who cannot answer these is itself a finding.
 
Stop crediting the wash step: If your HACCP plan credits washing with any parasite reduction, remove the credit unless you hold validation data supporting it. Reclassify the step honestly as cross-contamination control, and let the resulting gap justify your investment upstream.
 
Specify the test, not testing: Name the method, require the laboratory to confirm matrix validation for your commodity, the sample mass processed, and the limit of detection, then record in the verification plan what a negative result does and does not tell you.
 
Intensify seasonally: A supplier verification schedule that treats February and July identically is not risk-based.
 
Rehearse the outbreak you cannot test your way out of: Decide now who decides, on what evidence, how fast, and what you tell customers when you cannot confirm the hazard in your own product.
 
Conclusion

Eleven thousand four hundred and fifty-eight people, twenty states, two deaths, and not one positive food sample. That combination is the lesson that verification was not a failure of laboratory diligence, and better product testing would not have prevented it. It was a hazard introduced weeks before harvest, in water and sanitation conditions no processor controlled, on a commodity with no kill step, detected by a surveillance system that had recently been narrowed, in a facility that had not been visited in seven years.
 
We have grown comfortable with hazards we can test for and kill, where Cyclospora cayetanensis offers us neither. It obliges us to control what we cannot measure, through suppliers we do not own, in fields we will never visit, which is to say, it obliges us to do food safety management rather than food safety testing, which is harder, different work than anticipated.
 
 
Outbreak figures are current as of the CDC and FDA updates of 27 August 2026. The investigation remains open, and case counts are expected to change.
 
 

References
[1] Centers for Disease Control and Prevention. (27 August 2026). Cyclospora Outbreak Linked to Iceberg Lettuce. https://www.cdc.gov/cyclosporiasis/outbreaks/07-26/index.html
[2] U.S. Food and Drug Administration. (27 August 2026). Investigation of Multistate Outbreak of Cyclospora Illnesses: Iceberg Lettuce (July 2026). https://www.fda.gov/food/outbreaks-foodborne-illness/investigation-multistate-outbreak-cyclospora-illnesses-iceberg-lettuce-july-2026
[3] Centers for Disease Control and Prevention. Clinical Overview of Cyclosporiasis. https://www.cdc.gov/cyclosporiasis/hcp/clinical-overview/index.html
[4] University of Minnesota Extension. (July 2026). Cyclospora: What You Need to Know as a Fruit and Vegetable Grower. https://blog-fruit-vegetable-ipm.extension.umn.edu/2026/07/cyclospora-what-you-need-to-know-as.html
[5] Centers for Disease Control and Prevention. (14 July 2026). Domestically Acquired Cyclosporiasis Cases in Multiple U.S. States, 2026. CDC Health Alert Network Advisory HAN00531. https://www.cdc.gov/han/php/notices/han00531.html
[6] U.S. Food and Drug Administration. BAM Chapter 19b: Molecular Detection of Cyclospora cayetanensis in Fresh Produce Using Real-Time PCR. Bacteriological Analytical Manual. https://www.fda.gov/food/laboratory-methods-food/bam-chapter-19b-molecular-detection-cyclospora-cayetanensis-fresh-produce-using-real-time-pcr
[7] Dixon, B., et al. (2022). Verification and Use of the US-FDA BAM 19b Method for Detection of Cyclospora cayetanensis in a Survey of Fresh Produce by CFIA Laboratory. Microorganisms, 10(3), 559. https://doi.org/10.3390/microorganisms10030559
[8] Food Safety Magazine. (2025). CDC Slashes FoodNet Surveillance From Eight Foodborne Pathogens to Two. https://www.food-safety.com/articles/10646-cdc-slashes-foodnet-surveillance-from-eight-foodborne-pathogens-to-two
[9] Marler, W. (July 2026). Publisher's Platform: They stopped counting, and now they say they can't see. Food Safety News. https://www.foodsafetynews.com/2026/07/publishers-platform-they-stopped-counting-and-now-they-say-they-cant-see/
[10] CBS News. (August 2026). Farm linked to cyclosporiasis outbreak hadn't been inspected in 7 years as FDA lags on foreign inspection targets. https://www.cbsnews.com/news/taylor-farms-mexico-fda-inspection-cyclosporiasis-outbreak/
[11] Food Safety News. (December 2025). FDA investigated more than 30 outbreaks in 2025. https://www.foodsafetynews.com/2025/12/fda-investigated-more-than-30-outbreaks-in-2025/
[12] International Organization for Standardization. (2018). ISO 22000:2018 — Food safety management systems — Requirements for any organization in the food chain. Geneva: ISO.
[13] U.S. Food and Drug Administration. (May 2024). FSMA Final Rule on Pre-Harvest Agricultural Water. https://www.fda.gov/food/food-safety-modernization-act-fsma/fsma-final-rule-pre-harvest-agricultural-water
[14] Foundation FSSC. FSSC 22000 Additional Requirements. https://www.fssc.com/fssc-22000/fssc-22000-additional-requirements/
[15] Foundation FSSC. (2026). Update about FSSC 22000 Version 7. https://www.fssc.com/insights/fssc-22000-version-7/