The largest Cyclospora outbreak in American history is over. Federal investigators have closed the book on a summer 2026 outbreak linked to shredded iceberg lettuce from Taylor Farms de Mexico, with a final count of 12,883 laboratory-confirmed illnesses, 570 hospitalisations and 2 deaths across 21 states. The Food and Drug Administration concluded its investigation on October 2, 2026, without finding a conclusive root cause, and a legal analysis published on November 2, 2026, examining the outbreak’s recall and insurance lessons, gives those final numbers fresh relevance. This article is therefore a retrospective — a final-counts and lessons account — not a breaking-news report about a current outbreak.
Cyclospora is a microscopic parasite that causes an intestinal illness called cyclosporiasis, whose symptoms include watery diarrhoea, loss of appetite, weight loss, stomach cramps, bloating, nausea and fatigue. The illness can last for weeks if untreated, and it is particularly serious for people with weakened immune systems. Cyclospora is typically spread through food or water contaminated with faeces containing the parasite, and fresh produce — especially leafy greens and herbs that are eaten raw — has been implicated in many previous outbreaks. The 2026 iceberg lettuce outbreak dwarfed all of them in scale.
The two deaths in the outbreak both occurred in Michigan, in people who had underlying health conditions, according to federal figures. That detail matters, because it underlines that cyclosporiasis, while unpleasant for most healthy adults, can be life-threatening for vulnerable people. The 570 hospitalisations likewise show that this was not a mild stomach bug affecting a few dozen people: it was a major foodborne illness event that put hundreds of people in hospital and killed two.
Cyclospora iceberg lettuce outbreak: the final numbers
The FDA’s final count for the outbreak is precise, and it should be quoted precisely: 12,883 laboratory-confirmed illnesses, 570 hospitalisations, 2 deaths, across 21 states, with the last illness onset on August 17, 2026. Laboratory-confirmed means that each case was confirmed by a laboratory test identifying Cyclospora, not merely reported as a stomach illness that might have been cyclosporiasis. That standard makes the count conservative: the true number of people who fell ill is likely to have been higher, because many people with diarrhoeal illness do not seek medical care, do not have a stool sample tested, or are not tested specifically for Cyclospora.
The timeline of the outbreak’s official closure is also worth setting out. Taylor Farms voluntarily removed all central-Mexico iceberg lettuce on July 17, 2026, a step that stopped further distribution of the implicated product. The Centers for Disease Control and Prevention declared the outbreak over on September 11, 2026. The FDA concluded its investigation on October 2, 2026, and moved to what it calls post-outbreak response — monitoring, follow-up with industry, and work to prevent a recurrence, rather than active investigation of new cases. The November 2, 2026, analysis by the law firm Morgan Lewis, examining what the outbreak exposed about product recalls and insurance, is the reason this retrospective is timely now, months after the last illness onset.
That timeline also explains why consumers should not be alarmed by this article as if it described a current risk. The implicated lettuce was removed in July, the outbreak was declared over in September, and the FDA investigation closed in October. Shredded iceberg lettuce currently on sale is not the product implicated in this outbreak, and there is no suggestion in the federal record that the same supply chain remains a current danger. The story now is about what happened, why it happened on such a scale, and what the food system should learn from it.
How shredded lettuce from one Mexican supplier reached 31 states
The outbreak was linked to shredded iceberg lettuce from Taylor Farms de Mexico, a processing operation in central Mexico. Distribution of the implicated product was confirmed in 31 states between June 29 and July 16, 2026, a distribution footprint that explains how a single supplier could cause illnesses in 21 states. Shredded lettuce is a food-service product: it is sold in bulk to restaurants, cafeterias, catering operations and other institutional kitchens, where it is used in salads, tacos, sandwiches and other dishes. A single batch of contaminated shredded lettuce can therefore reach thousands of meals across many states before anyone realises there is a problem.
That distribution model is also why the outbreak was so large. Unlike a head of lettuce bought by a single household, shredded lettuce is mixed, bagged and shipped in bulk, and a contamination event at a processing plant can affect a very large volume of product. The lettuce is eaten raw, so there is no cooking step to kill the parasite. And because cyclosporiasis has an incubation period — symptoms typically appear about a week after exposure, and sometimes longer — cases emerge gradually over weeks, making it harder to link them quickly to a single food source.
The investigation that linked the outbreak to Taylor Farms de Mexico involved epidemiological work — interviewing patients about what they ate, identifying common foods — combined with traceback work, tracing the supply chain backwards from restaurants and kitchens to distributors and then to the processing plant. That work is painstaking, and it is one reason the final count took months to settle. By the time the link was firm, the product had already been distributed widely, and the voluntary removal on July 17 was a response to an outbreak already under way, not a preventive recall before anyone fell ill.
The 12,883-case count — and why other tallies are higher
Readers who search for Cyclospora numbers from 2026 will find figures much larger than 12,883, and it is essential to explain why, rather than leaving the impression that one of the figures is wrong. The FDA’s count of 12,883 is the outbreak count: laboratory-confirmed illnesses attributed specifically to this outbreak, linked to the Taylor Farms shredded iceberg lettuce, across 21 states. Other figures count different universes, and mixing them up would produce a misleading picture.
The CDC’s season count, for example, is far larger: 19,883 laboratory-confirmed domestic Cyclospora cases to September 15, 2026, with 1,064 hospitalisations and 2 deaths, across 49 states and the District of Columbia. That figure counts all laboratory-confirmed domestic cyclosporiasis cases in the season, not only those attributed to the iceberg lettuce outbreak. It therefore includes cases from other sources, other foods, and other exposures that happened during the same summer, as well as the outbreak cases. It is a season total, not an outbreak total, and it should not be quoted as the size of the lettuce outbreak.
A third figure is larger still: CDC notifiable-disease tables recorded 32,286 Cyclospora cases through October 3, 2026, compared with 4,042 cases in the same week in 2025. That table counts cases reported through the national notifiable-disease system, which includes cases that may not meet the stricter laboratory-confirmed outbreak definition, and which reflects reporting practices as well as true incidence. Michigan alone reported about 14,277 to 14,660 cases in state and CDC tallies, a figure that exceeds the FDA’s national outbreak count and illustrates how state-level reporting and outbreak attribution can diverge. The lesson is not that any agency miscounted, but that “how many people got sick” depends on the question being asked: sick from this outbreak, sick with Cyclospora this season, or reported through the surveillance system. This article uses the FDA outbreak count — 12,883 — as its headline figure, because that is the count for the outbreak itself.
What investigators found — and what they never found
The most striking finding of the investigation is also its most frustrating: investigators never found a conclusive root cause, and no product sample ever tested positive for Cyclospora. That statement needs to be made clearly, because it is easy to assume that a foodborne outbreak investigation ends with a laboratory test proving that a particular batch of food was contaminated. In this case, it did not.
What investigators did find was Cyclospora in environmental samples: in a wastewater tank at the processing plant, and in a drainage ditch at a grower. Those findings suggest that the parasite was present in the production environment, but they do not prove that it contaminated the specific lettuce that reached consumers, and they do not identify the precise point at which contamination occurred. One border sample that initially appeared positive was later determined to be a false positive and was withdrawn, a reminder that laboratory testing for Cyclospora is complex and that a single positive result must be confirmed before it is relied upon.
The absence of a positive product sample does not mean the lettuce was not the source. The epidemiological evidence — the pattern of illnesses, the common food exposures, the traceback to a single supplier — was strong enough for the FDA and CDC to attribute the outbreak to the shredded iceberg lettuce and for Taylor Farms to remove the product. But the absence of a laboratory-confirmed product sample does mean that the investigation could not pinpoint how the parasite got into the lettuce, whether through water, through handling, through a field-level source, or through some other route. Without that answer, prevention recommendations must remain general — improved water management, better sanitation, stronger environmental monitoring — rather than targeted at a single, proven failure.
The July 17 removal and the October close of the investigation
Taylor Farms’ voluntary removal of all central-Mexico iceberg lettuce on July 17, 2026, was the decisive public-health action in the outbreak. By removing the product from distribution, the company stopped further exposures from that supply chain, even though the root cause remained unknown. Voluntary removals of this kind are common in foodborne outbreak responses: a company acts on the epidemiological evidence, rather than waiting for a laboratory proof that may never come, because waiting would mean allowing more people to fall ill.
The CDC’s declaration on September 11, 2026, that the outbreak was over reflected the fact that no new illnesses linked to the outbreak were emerging, with the last onset on August 17. The FDA’s conclusion of its investigation on October 2, 2026, marked the formal end of the active investigation phase. Post-outbreak response, which follows, includes monitoring for any late cases, working with the company and the industry on preventive measures, and reviewing whether regulatory changes are needed. It does not mean the agencies have stopped caring about Cyclospora; it means this outbreak, as an investigation, is closed.
For consumers, the practical takeaway from the closure is reassurance, not complacency. The specific product and supply chain implicated in this outbreak are no longer in distribution, and the outbreak is over. But Cyclospora remains a recurring summer risk in the United States, with cases reported every year, and fresh produce eaten raw will always carry some risk. Washing produce, buying from reputable sources, and seeking medical care for prolonged diarrhoeal illness — particularly for people with weakened immune systems — remain sensible precautions, even though washing alone cannot guarantee removal of Cyclospora from leafy greens.
What the outbreak exposed about recalls and insurance
The November 2, 2026, Morgan Lewis analysis that makes this retrospective timely focuses on what the outbreak exposed about product recalls and insurance — the legal and financial machinery that operates behind a foodborne outbreak, largely invisible to consumers. When a product is removed from the market, questions arise immediately: who bears the cost of the removal, who compensates restaurants and distributors that had to discard product, who pays for the medical costs of people who fell ill, and what insurance covers those liabilities. In an outbreak of this scale — 12,883 illnesses, 570 hospitalisations, 2 deaths — those questions involve very large sums.
The analysis, as described in reporting on it, highlights gaps in how recall and insurance arrangements handle a large, multi-state outbreak where the root cause is never conclusively proven. If no product sample tests positive, insurers and suppliers may dispute liability. If the contamination source is environmental rather than product-specific, it may be unclear which policy applies. If distribution spans 31 states and involves many intermediaries, tracing financial responsibility becomes as complex as tracing the food itself. Those gaps matter because they affect whether affected businesses can recover their losses, whether injured consumers can obtain compensation, and whether companies have the right incentives to invest in prevention.
The broader lesson of the 2026 Cyclospora outbreak, then, is not only about lettuce. It is about the food system’s capacity to detect, trace, remove and learn from a contamination event that affects thousands of people across many states, even when the laboratory proof is elusive. The FDA’s final count — 12,883 sick, 570 hospitalised, 2 dead — is a record for Cyclospora in the United States, and it should prompt the industry, regulators and insurers to examine whether their systems are adequate for an outbreak of this scale. The fact that the outbreak is over does not mean its lessons are closed. On the contrary, the retrospective now under way, prompted by the November analysis, is the right time to ask whether the next outbreak — and there will be a next Cyclospora season — will be smaller, detected faster, and traced more conclusively than this one was.
Sources
USN reviewed reporting from multiple outlets for this story. Read more from US Food and Drug Administration, Morgan Lewis and Food Poison Journal.