Operations

Cyclospora not an easy trace, says supply chain expert

As the largest Cyclospora outbreak in U.S. history continues to unfold, restaurant operators are once again facing the reputational fallout of a food safety issue that may have originated long before produce reached their kitchens.

Photo: Adobe Stock

July 29, 2026 by Valerie Gritton

Summarize with

When Taco Bellannounced it had voluntarily removed lettuce from its supply chain, the restaurant industry took notice. Linked to an outbreak of the Cyclospora parasite across the states of Michigan, Kentucky, Indiana, Ohio and West Virginia, Taco Bell removed the affected produce — in this case, shredded iceberg lettuce — from its lineup.

That outbreak has now been extended to include Pennsylvania, Kansas, Illinois and Oklahoma, as the investigation continues.

Taco Bell has so far been the only national chain with ties to the outbreak despite Jack in the Box confirming they received a shipment of Cyclospora-contaminated lettuce (the chain said in a statement they immediately removed the lettuce from their supply).

With more than 4,000 laboratory-confirmed cases under investigation by the Federal Food and Drug Administration, and another 7,400 unconfirmed cases, this has been the largest outbreak of the Cyclospora foodborne illness in U.S. history.

So what made this year different than the rest? It could be several factors, says Julie Swann, PhD, Department Head of the Edward P. Fitts Department of Industrial and Systems Engineering at North Carolina State University. Swann is also past president of the Institute for Operations Research and the Management Sciences (INFORMS) and served as a CDC Senior Science Advisor during the H1N1 response. She also has written on outbreak responses for The Hill.

The season for Cyclospora is May through August, which means the parasite thrives during warmer months. But heat — such as the heatwave in Michigan, where a staggering 9,253 cyclospora cases have been reported by the Michigan Department of Health and Human Services — isn't enough.

Weather conditions such as heavy rainfall, flooding, drought and irrigation challenges may create conditions where contamination becomes more likely, said Swann. And so can the size of the manufacturing facility, especially if one is cutting lettuce from several different places. When that happens, the contamination chain can look something like this:

Produce becomes contaminated at the farm level.
The produce moves to a processing facility where it merges with the same type of produce from other farms or locations.
A machine used to cut or process the produce becomes contaminated.
Multiple products and bags then become contaminated.
Those products are distributed across multiple states and restaurant locations.

This is why some large processors can be associated with widespread outbreaks and a single contamination event can quickly become a national issue, said Swann.

Couple that with manual traceability procedures due to the the absence of widespread digital traceability and you've got the perfect environment for an outbreak to spread.

"Right now, a lot of states still have a pretty manual process for tracing the potential sources of an outbreak," said Swann. "They're conducting manual interviews and then that data goes to the CDC, who shares product information with the FDA. Then the FDA has to go through their supply chain records going back to brands and specific farms. If that takes two to three weeks, that contaminated lettuce may have been widely distributed already. Not to mention, symptoms of Cyclospora can take to two weeks to show up."

How the manual investigative process works:

Health departments interview patients about what they ate.
Investigators look for common food exposures.
Information is compiled and sent through public health systems.
The FDA then works backward through supply-chain records to identify potential farms, processors and suppliers.

The need for digital supply chain traceability

One proposed solution is a more connected, digital supply chain.

As it stands, Walmart has a more advanced digitally standardized supply chain than most places, having invested heavily in end-to-end traceability systems that allow products to be tracked through the supply chain to their ultimate sources.

But adoption of full traceability remains inconsistent across the industry.

The FDA's Food Safety Modernization Act (FSMA) traceability requirements were designed to improve tracking, but implementation has faced delays, partly because smaller suppliers face cost and technology challenges.

The Act, first approved in 2022, was supposed to go into effect January 20, 2026; however, in March 2025 it was extended to July 20, 2028.

The FDA said at the time that the delay was due to implementation challenges related to supply-chain coordination, technology readiness, industry requests and the need for consistent implementation. The administration also said it wanted all covered entities to come into compliance at the same time so the traceability chain would be complete.

In March 2025, the FDA released a statement about the delay: "Accordingly, the compliance date extension does not amend, nor do we intend to amend, the requirements of the final rule, which will improve food safety and protect public health. Instead, the compliance date extension affords covered entities the additional time necessary to ensure complete coordination across the supply chain in order to fully implement the final rule's requirements — ultimately providing FDA and consumers with greater transparency and food safety. "

Why Cyclospora is particularly difficult

It's difficult to determine if FSMA would have prevented a Cyclospora outbreak as unlike some bacteria such as E. coli or Salmonella, Cyclospora is a parasite. Washing produce alone doesn't kill it nor is it easily detected through traditional approaches.

The parasite can survive in produce crevices, Swann said, as was the case with the 1996 outbreak tied to fresh raspberries imported from Guatemala.

One thing brands and consumers can do: stay away from pre-cut bags of lettuce as that seems to pose the greatest risk. Swann said pre-cut lettuce creates vulnerabilities because it has already been processed, cutting equipment can spread contamination, and consumers and restaurants have fewer opportunities to remove contamination.

"The fast-food restaurants that cut (their lettuce) in-house are less likely impacted than those that get it pre-cut," Swann said, "because then your source of contamination might be an employee without washed hands … instead of contaminated pre-cut lettuce from a processing plant distributed to multiple locations."

Restaurants as the final link; not always the source

For restaurant operators, outbreaks create a difficult situation.

Brands often become the public face of a foodborne illness because that is where consumers remember eating. But, like the case with Taco Bell, contamination may have occurred much earlier in the supply chain.

Taylor Farms' iceberg lettuce was cited as the source of the Cyclospora parasite linked to Taco Bell locations. In mid-July, the California-based company issued a statement saying its Taylor Farms de Mexico offshoot was voluntarily removing from the U.S. market all iceberg lettuce sourced from central Mexico. The company has since announced that it has suspended all iceberg lettuce sourcing and production from central Mexico.

In a July 24 statement, Taylor Farms said:

"We are passionate about helping people live healthier lives through fresh produce, and the safety of our food is paramount. We maintain best-in-class Cyclospora prevention protocols and invest more than $200 million annually into our independently audited and verified food safety protocols. … Additionally, we've commissioned independent experts to conduct a top-to-bottom review of food safety processes and protocols in our central Mexico facility, whereas of July 18, 2026, we have temporarily suspended production of all products. We continue to work with health authorities, customers, and independent farming partners to address this issue." (Read the full statement here)

The statement despite the FDA's reporting of a false positive on Taylor Farms' iceberg lettuce. This means the FDA has not identified a single positive test for Cyclospora on produce, something that would be difficult for them to do, said Swann. This is because by the time Cyclospora outbreaks are identified, the suspected produce has often already been distributed, consumed, or discarded, making laboratory confirmation difficult.

"The lettuce that may have caused illnesses was shipped weeks earlier. That product is gone from the company's supply chain by the time the outbreak is recognized, so you can't simply go back and test the contaminated lettuce. That is why you cannot rely on a test at the manufacturing plant to confirm the source weeks after the outbreak begins," Swann said.

The outbreak overall underscores the significance of giving restaurant operators greater visibility into their supply chains. While Colorado and Minnesota have made advances in speed to identify potential products based on information from patients, this is only one half of the broader traceability issue as country-wide digital traceability standards will ultimately play a critical role in improving outbreak response times and contamination periods. Until then, operators can help reduce their risk by sourcing local when feasible and purchasing whole-head lettuce they can cut or shred in-house.

"When we have that full traceability in place, it should shorten an outbreak period because people will be able to respond faster" and less contaminated products will stay on shelves, Swann added.