On Tuesday the Secretary of Health and Human Services told ABC News that the Cyclospora outbreak is “under control”, that extensive epidemiological forensics had identified the source, and that a recall had been implemented. That was two days ago. Here is what the numbers have done since.
Michigan reported 7,664 cases on Thursday, up 493 in a single day. But the number that should stop everyone is the one Michigan only publishes on Thursdays. As of July 23, 160 people in Michigan have been hospitalized. A week earlier it was 102. The week before that, 44. That is a state where the number of people sick enough to require a hospital bed has more than tripled in fourteen days. Michigan normally sees about fifty Cyclospora cases in an entire year. It has now hospitalized more than three times that many people this month.
Indiana more than doubled. The Indiana Department of Health reported 684 cases on Thursday, in people ranging in age from eight to ninety-eight. On July 16 the same state dashboard showed 327. Allen County alone now has 109 cases, more than the entire state was reporting ten days ago.
North Carolina rose 83 percent in a week, from 307 cases on July 14 to 561 by July 21, with 366 of those in Wake County. And North Carolina said something that ought to end the “we found it” conversation. The state’s public health veterinarian, Dr. Carl Williams, told reporters that his state’s outbreak most likely has multiple vehicles rather than one food product from one company.
Then there is Ohio, which is running two sets of books. The state health department’s statewide count has not moved off 1,316 since July 16. The health departments of northwest Ohio, meanwhile, counted 2,268 cases on July 22, with 1,044 in Lucas County alone. Ohio, for its part, does not appear to think this is under control. The state has asked the CDC for in-person help, and the agency is sending disease detectives to Ohio for about three weeks.
Neither, it turns out, does the FDA. On Wednesday the agency opened a second Cyclospora outbreak investigationcovering 72 people. The product has not been identified. The location has not been disclosed. The same week the government announced it had found the source and fixed the problem; it also announced a brand-new investigation into an unknown food making people sick somewhere in America.
Reported 2026 cyclosporiasis cases in all fifty states, as published by each state as of July 23, 2026. Every figure is that state’s own most recent count, so the “as of” dates differ. Fifteen states publish no 2026 count at all and three publish only a range. Together the states that do publish add up to roughly 12,450 people — a floor, not a total.
Nationally, the CDC now counts 4,173 laboratory-confirmed, domestically acquired cases across 41 states, with more than 7,400 additional cases that are not yet laboratory confirmed — roughly 11,500 people in total. The hospitalization figure went from 141 to 308 in a week. It more than doubled. And separate from all of that, the agency is carrying 767 travel-associated cases with 33 more hospitalizations, which means the CDC’s real confirmed total for 2026 is closer to 4,940.
Which brings us to the part that is not a data problem. Cyclosporiasis surveillance was mandatory in the CDC’s FoodNet program from 1997 until July 2025, when the agency narrowed the required list from eight pathogens to two and made Cyclospora optional. Senator Amy Klobuchar wrote the CDC about it on July 14. Representative Greg Stanton wrote the Secretary on July 15, demanding by August 3 to know who ordered the reduction, what funding was pulled since January 2025, how many surveillance staff were terminated or left vacant, what system now performs the active laboratory outreach FoodNet used to do, and how many people are actually assigned to this response. Senator Jon Ossoff wrote on July 16 and gave the Secretary 72 hours to say whether required Cyclospora surveillance had been restored and, if not, why not.
In fairness, the FoodNet cut is not the whole story, and I am not going to pretend otherwise. Barbara Kowalcyk of George Washington University makes the point that FoodNet was built to track long-term trends, not to detect outbreaks — that job belongs to the notifiable disease system and to PulseNet. She is right. But that defense is narrower than it sounds. What FoodNet gave us was the baseline that tells you how bad a year is while you are still in it. Take it away and you get exactly what happened here: a state health department in Michigan noticing something wrong in late June, the rest of the country flying blind for two weeks, and a federal agency whose national count sat frozen for nine days while Michigan added thousands of cases.
None of this is bad luck. The Food Traceability Rule’s lot-level recordkeeping requirement was supposed to take effect on January 20, 2026. The first illnesses in this outbreak began in mid-May. Had that rule been in force, the records needed to trace this lettuce would have been a legal obligation four months before the first person got sick. Instead, the FDA proposed a thirty-month delay and Congress made it binding, pushing compliance to July 2028.
The USDA’s Microbiological Data Program (MDP), which tested lettuce and spinach already sitting in commerce for about five million dollars a year, was lobbied out of existence in 2012. We took away the program that found contaminated produce, then the rule that would let us trace it, then the surveillance that would let us count the sick. Now we are surprised that we cannot find, trace, or count.
Restart MDP. Put Cyclospora back in FoodNet. Put the Food Traceability Rule into force. Restore the funding that lets a state laboratory answer a question in days instead of weeks. Until then, an outbreak is “under control” the moment we stop being able to see it — and that is not the same thing as it being over.
Where each state stands tonight, with the source for every number.
| State | 2026 cases reported | Part of the Taco Bell outbreak? | Source |
| Alabama | No 2026 count published | Not reported as part of the outbreak | CDC |
| Alaska | 5; 3 travel-related | No – AK DOH: no link to the outbreak | AK DOH / Epoch |
| Arizona | 19 | Cases reported; not in cluster | AZ DHS / Epoch |
| Arkansas | 26 year-to-date | Under investigation for outbreak link | AR DOH / Epoch |
| California | 41 provisional (Jul 14) | No – CDPH: no local acquisition identified | CDPH |
| Colorado | 150; 4 hospitalized; 8 of 120 domestic | No – CDPHE: not part of the Midwest outbreak | CDPHE / Epoch |
| Connecticut | 35 (up from 19 in 2025) | Links its cases to the national outbreak | CT DPH |
| Delaware | No 2026 count published | Not reported as part of the outbreak | CDC |
| Florida | 106 | No – FL DOH: seasonal disease Florida sees yearly | FL DOH / Epoch |
| Georgia | 11–30 domestic since May 1 | No – GA DPH: no Georgia-specific cluster | GA DPH / Epoch |
| Hawaii | No 2026 count published | Not reported as part of the outbreak | CDC |
| Idaho | No 2026 count published | Not reported as part of the outbreak | CDC |
| Illinois | 277 (Jul 16); 23 hospitalized | No – IDPH: higher than average, no single cause | IDPH / TODAY |
| Indiana | 684 (Jul 23), up from 327 on Jul 16; ages 8–98; Allen Co. 109 | YES – Taco Bell outbreak state; daily updates | IN DOH / WISH-TV |
| Iowa | 57; about half domestic | No – IA HHS: not connected to national investigations | IA HHS / Epoch |
| Kansas | 55 (Jul 15); 37 domestic | Domestic cases rising; no Kansas source found | KDHE |
| Kentucky | 192 (Jul 15); 108 confirmed; 7 hospitalized | YES – Taco Bell outbreak state; weekly updates | KY DPH / Epoch |
| Louisiana | 1–10 | Not declared part; not in cluster | LA DOH / Epoch |
| Maine | No 2026 count published | Not reported as part of the outbreak | CDC |
| Maryland | 69; some travel-related | No – no common link identified | MD DOH / Epoch |
| Massachusetts | 18 (normal seasonal amount) | No – MA DPH: not affected by the Midwest outbreak | MA DPH / Epoch |
| Michigan | 7,664 (Jul 23), up 493 in a day; 160 hospitalized (Jul 23), up from 102 a week earlier | YES – leads the outbreak; daily updates on weekdays | MDHHS / WOOD TV |
| Minnesota | 41 since May 1 | No – MDH: no increase over expected | MDH / Epoch |
| Mississippi | No 2026 count published | Not reported as part of the outbreak | CDC |
| Missouri | 216 (Jul 19), up from 43 on Jul 12; state normally sees about a dozen a year | Not declared part of the Taco Bell cluster | MO DHSS / KBIA |
| Montana | No 2026 count published | Not reported as part of the outbreak | CDC |
| Nebraska | 49 | No – NE DHHS: none related to the wider outbreak | NE DHHS / Epoch |
| Nevada | No 2026 count published | Not reported as part of the outbreak | CDC |
| New Hampshire | 1–10 | Cases reported; not in cluster | NH DHHS / Epoch |
| New Jersey | 46 (May 1–Jul 11); within typical range | No – NJDOH: no clusters or outbreaks | NJDOH |
| New Mexico | No 2026 count published | Not reported as part of the outbreak | CDC |
| New York | 517 (May 1–Jul 13) incl. NYC | No – NYSDOH: not a major deviation from the norm | NYSDOH / Epoch |
| North Carolina | 561 (Jul 21), up from 307 on Jul 14; 13 hospitalized; Wake Co. 366 | Statewide outbreak; NCDHHS says likely multiple sources, not the Taco Bell cluster | NCDHHS / WRAL |
| North Dakota | No 2026 count published | Not reported as part of the outbreak | CDC |
| Ohio | 1,316 statewide (Jul 16), not updated since; 96 hospitalized. Northwest Ohio alone reports 2,268 (Jul 22) | YES – Taco Bell outbreak state; CDC sending field staff for about three weeks | ODH / Toledo Blade |
| Oklahoma | 57; 6 hospitalized | Part of the national outbreak; no Oklahoma source | OSDH / Epoch |
| Oregon | No 2026 count published | Not reported as part of the outbreak | CDC |
| Pennsylvania | 28; reporting is voluntary | No – mostly travel-related | PA DOH / Epoch |
| Rhode Island | 4 since May 1 | Cases reported; not in cluster | RI DOH / Epoch |
| South Carolina | No 2026 count published | Not reported as part of the outbreak | CDC |
| South Dakota | No 2026 count published | Not reported as part of the outbreak | CDC |
| Tennessee | 11–30 | Investigating; not in cluster | TN DOH / Epoch |
| Texas | 68 (Jul 13); 15 hospitalized; all domestic | Meets CDC case definition; no source identified | TX DSHS |
| Utah | 1–10 | No – UT DHHS: not related to the wider outbreak | UT DHHS / Epoch |
| Vermont | No 2026 count published | Not reported as part of the outbreak | CDC |
| Virginia | 79 (Jul 20), up from 37 on Jul 4; 38 domestic, 27 travel, 14 unknown | No – VDH: no evidence of a Virginia outbreak; now posts weekly on Mondays | VDH |
| Washington | 27 since May 1; 5 domestic or possibly domestic | No – WA DOH: not associated with other states | WA DOH / Epoch |
| West Virginia | 195 (Jul 21); 15 hospitalized – nearly tripled since Jul 13 | YES – Taco Bell outbreak state; updates Tuesdays and Fridays | WV Dept. of Health |
| Wisconsin | 61 (May 1–Jul 15); 11 domestic | No – WI DHS: no common food item identified | WI DHS / Epoch |
| Wyoming | No 2026 count published | Not reported as part of the outbreak | CDC |
A word on the counts. Where a state publishes its own figure I used it, because state health departments are closer to the illnesses and update more often. Michigan and Indiana post daily on weekdays, West Virginia Tuesdays and Fridays, North Carolina Tuesdays, Virginia Mondays, Ohio and Kentucky weekly — so any national total is a blend of numbers of different ages, and fifteen states publish no 2026 count at all while three more publish only a range. The roughly 12,450 these fifty numbers add to is a floor, not a ceiling.