On January 15, 2025, the FDA and the CDC closed the investigation into a November 2024 E. coli O157:H7 outbreak in romaine lettuce. Eighty-nine people sick in fifteen states. Thirty-six of them hospitalized. Seven with hemolytic uremic syndrome, which is the clinical way of saying a child's kidneys shut down. One person dead. The agencies recorded the vehicle as romaine lettuce from a common supplier and published nothing further. No processor. No grower. No ranch. No lot. The public advisory that had gone out for every comparable romaine outbreak since 2010 was simply never written for this one.
When NBC News surfaced the agency's own internal report that April, FDA's explanation was that it names a firm when the evidence supports it and when there is actionable advice to give consumers, and that by the time investigators confirmed the likely source the outbreak was already over and there was nothing left for anyone to act on. That reasoning has been reported and re-reported ever since, and the agency has never walked it back.
The name existed the whole time. It was in the traceback summary FDA itself wrote, sitting behind gray boxes the agency claimed as trade secret. Our own epidemiologist found the thread running through clients who were whole-genome-sequencing matches to one another, and the name reached the public in April 2025 through federal court filings rather than through a government press release: one processor, Taylor Farms of California in Salinas, and one grower, Anthony Costa & Sons in Soledad, with the lettuce at four of the five points of service running back to the same ranch and the same lot. It took me the better part of a year after that to pry the redactions off. You can read the unredacted traceback summary yourself, and I have already written at length about what those pages say and what the boxes were hiding. Taylor Farms denied it then and denies it now: its position is that its product was not the source and that its own raw and finished product testing showed nothing — sound familiar?
Here is my quarrel with no actionable advice for consumers. It defines the audience as one person, a shopper holding a bag of lettuce, and that person was in fact past helping, because the romaine was eaten in November. But the shopper was never the only one who needed the name.
Sysco needed it. US Foods needed it, and Performance Food Group, Markon, Walmart, Yum Brands, Subway and Jack in the Box, every one of them a buyer with a supplier decision in front of them and a contract with terms in it. A food service director at a hospital in Keene, New Hampshire needed it. A state epidemiologist deciding which supplier names belong on a questionnaire needed it. A member of Congress with a traceability rule sitting on the calendar needed it. And Taylor Farms needed it, because a company answering questions in public is a different company than one that is not.
The obvious objection is worth meeting head on. Taylor Farms had already been named in public eight weeks earlier, in the October 2024 slivered onion outbreak that ran through McDonald's Quarter Pounders and sickened 104 people in fourteen states, hospitalized thirty-four, gave four of them HUS and killed one, and the buying went right on. True. But that outbreak was framed as an onion problem at one plant in Colorado Springs, and the company handled it that way, with a recall that went to foodservice customers by direct notice, no consumer-facing announcement at all, and a Form 483 that almost nobody read. One outbreak is an incident. Two fatal outbreaks eight weeks apart, at two different plants, in two different commodities, is a company. The second name is what turns an incident into a pattern, and the second name is the one the FDA kept from the public.
A company-level record does something to a regulator that a commodity-level record does not. It makes the next question obvious: what else does this firm run, and where. FDA already had an answer on file. In 2013 the same corporate family's plant at Doctor Mora, in Guanajuato, was at the center of a Cyclospora outbreak that sickened 631 people in twenty-five states, and FDA's own environmental assessment recommended finding out whether Cyclospora is a reasonably likely hazard in that growing region and, if it is, re-evaluating the salad mix wash step. The agency let the plant go back to work partly on the company's promise to test its water, and thirteen years later I cannot find a single public result. A disclosure in January 2025 would not by itself have found a parasite in Mexico. It would have made go look at the rest of Taylor Farms a question somebody had to answer in writing.
Congress is the other place the name would have landed. Rosa DeLauro demanded answers about the 2013 outbreak while it was still running, and asked the same questions again in 2018, and she is the senior Democrat on the appropriations subcommittee that funds the FDA. In November 2025 Congress directed the agency not to enforce the Food Traceability Rule before July 20, 2028. That is the rule whose compliance date, January 20, 2026, arrived four months before the first illness in the outbreak we are living through now. I cannot tell you that a disclosure ten months earlier would have changed one vote. I would have liked to watch somebody defend that rider with a fatal, unnamed, unannounced romaine outbreak on the record behind them.
I am not going to claim that the silence of January 2025 caused the outbreak of May 2026. Different plant, different country, different commodity, a different organism with a different biology, and I have spent thirty years telling other people not to overreach on causation. What I will say is this. Every mechanism that might have caught this one early, a buyer asking harder questions before it signed, a regulator taking a second look at the rest of the company's facilities, a traceability rule actually in force, a state health department that already had a supplier name in its head when the interviews started, was weaker on May 13, 2026 than it would have been if the FDA had done in January 2025 the plain thing it chose not to do. That is my opinion. I hold it, and I think the record supports it.
Look at where that leaves us. CDC confirms 1,947 cases in nine states, and every one of those cases is defined by having eaten at a Taco Bell. Add up what the fifty states report on their own and the floor is 18,209.Michigan crossed ten thousand this morning, with 160 people hospitalized. New Hampshire's health department tied seventeen cases to recalled Taylor Farms lettuce at a hospital cafeteria salad bar in Keene, and it is still the only state in the country that has named a place. Set all of that against the company's outbreak and recall record going back to 2009 and tell me the ledger did not matter.
There is something to do about this, and it has been sitting at the FDA since February. Stop Foodborne Illness filed a citizen petition on February 4 asking the agency to adopt a policy of publicly disclosing the names of every company associated with a foodborne illness outbreak, whether or not there is a recall attached. The legal argument is clean. The Trade Secrets Act protects sales figures and proprietary processes, not the factual identity of a company that sells food to the public, and the D.C. Circuit has held that a company name is not commercial information in and of itself. If the agency insists on reading the statute its own way, the petition asks it to disclose anyway under the Food, Drug and Cosmetic Act or by revising its own regulation at 21 C.F.R. 20.91. None of that requires a rulemaking. The Commissioner could grant it this week with a memorandum. I said the petition was right in June and I will say it again today.
Now read the petition's own reasoning against the file the agency closed in January 2025. Disclosure prompts people who got sick and never reported it to go get counted. It tells anyone still holding the product not to eat it. And it gives a company whose name is in the newspaper a reason to redouble the work. Not one of those three things happened in 2025, because there was no name to attach them to. The petition also makes the produce point better than I have managed to. Fresh produce is perishable, so a produce outbreak often ends without a recall, and a policy that releases names only when there is a recall therefore falls hardest on precisely the commodity that causes the most outbreaks. That is not an unfortunate side effect. That is the entire mechanism of the gray box, and it is why leafy greens keep coming up nameless.
The petition's lead example is the November 2024 romaine outbreak, and the child it describes is my client. Colton George, nine years old, eighteen days in the hospital, nine days of continuous dialysis and five more of intermittent dialysis, five transfusions, and a nephrologist he is still seeing. His father spent months trying to learn the name of the company that sold the lettuce that did that to his son, and finally wrote about it himselfbecause nobody at the agency would tell him. A father should not have to run his own traceback. My one addition to the petition is this: it speaks of the consumer-facing company, and in this outbreak, there was no such thing. The lettuce moved from a grower to a processor to a distributor to a caterer and onto a banquet plate with no brand on it anywhere. Disclosure has to reach the processor and the grower too or produce outbreaks will keep ending in gray boxes for the simple reason that nobody's logo was on the bag.
Transparency is not a courtesy the government extends to a consumer standing in a produce aisle when it happens to be convenient. It is a record. It is what a buyer reads before it signs, what a regulator reads before it schedules an inspection, what a member of Congress reads before voting on a rider, and what a jury reads years later when the people who got sick finally get their day. FDA's rule is that it names a firm when consumers can act on it. The November 2024 romaine outbreak is the proof that the rule is written for the wrong audience. Eighty-nine people got sick, one of them died, seven children's kidneys failed, and the only reason anybody knows who it did is that I sued and made the government hand over the pages it had blacked out. Since 1993 I have been saying that is a terrible way to run a food safety system. It still is.
One last thing, for the record. Below is every Taylor Farms outbreak I could find that has a public federal or state document attached to it. Read the list and then notice what is missing from it. The November 2024 romaine outbreak, the one this whole post is about, is not there. No CDC investigation page. No FDA outbreak page. No public notice of any kind. It exists in the public record only because we sued and put an unredacted PDF on this blog. That is what a gray box actually does. It does not hide a name for a season. It keeps an entire outbreak out of the ledger permanently, and eighty-nine people disappear with it.
2026, Cyclospora, iceberg lettuce. FDA investigation page and the CDC investigation update.
2024, E. coli O157:H7, onions served at McDonald's. CDC investigation update and the FDA outbreak investigation.
2021, E. coli O121:H19, romaine lettuce. The NORS report and the outbreak summary slides.
2015, E. coli O157:H7, Costco rotisserie chicken salad. CDC's final update. Never officially attributed to a common source, though Taylor Farms recalled the celery and onion diced blend that went into the salad, and the FDA recall notice is no longer available online.
2013, Cyclospora, bagged salad mix. MMWR Notes from the Field, CDC's 2013 outbreak investigation page, FDA's environmental assessment, and the Nebraska and Iowa regional investigation.
2009, Salmonella Typhimurium, shredded lettuce. The Oregonian's contemporaneous report, plus the traceback and the Oregon health alert — both of those still redacted, seventeen years later.
