Well, fuck. Here we are again.
Back in 2024, I wrote McDonald’s Passes the Potato of Blame to Taylor Farms: E. coli 2024 after McDonald’s Quarter Pounders were implicated in an outbreak of E. coli O157:H7. At the time, McDonald’s was taking a very public beating while investigators worked to determine whether the source was the beef or the slivered onions supplied by Taylor Farms.
The investigation eventually pointed to the onions. FDA concluded that fresh, slivered onions were the likely source based on epidemiologic and traceback evidence, and Taylor Farms recalled the implicated onions. By the time the outbreak was over, 104 illnesses had been reported across 14 states, 34 people had been hospitalized, four developed hemolytic uremic syndrome, and one person died.
For the sake of scientific accuracy, investigators never recovered the outbreak strain from the onions or environmental samples. Epidemiologic and traceback evidence led investigators to the onions, and that distinction matters. This may be Food Safety Dumpster Fire, but we’re still going to practice science here.
I didn’t particularly expect to be writing a sequel two years later.
Yet on September 11, 2026, CDC announced the end of the largest recorded multistate Cyclospora outbreak in the United States. This time, the implicated product was iceberg lettuce from Taylor Farms de Mexico.
The final count was 12,883 reported illnesses across 21 states, at least 570 hospitalizations, and two reported deaths.
Almost thirteen thousand reported illnesses.
And anyone who works in foodborne illness surveillance knows that a confirmed case count does not necessarily capture every person who actually got sick.
This wasn’t lettuce coming out of some tiny operation with no resources, no sophisticated food safety system and no idea what FSMA stands for. Taylor Farms is a major supplier whose products move through enormous foodservice and retail supply chains.
And this is where we’re going to talk about money, because apparently we’re not supposed to do that when we talk about food safety.
Follow the Money, Then Explain the Excuses
Taco Bell’s parent company, Yum! Brands, reported more than $8.2 billion in revenue and approximately $1.56 billion in net income in 2025.
Walmart reported approximately $713 billion in revenue for fiscal year 2026.
Billion. With a B.
I understand that revenue isn’t profit. Nobody needs to send me an Economics 101 lesson. The point is scale and resources.
Modern multinational food companies operate extraordinarily sophisticated systems for procurement, logistics, analytics, marketing, automation, inventory management and consumer behavior. We can move highly perishable products across international borders and distribute them through thousands of locations with remarkable speed and precision.
So, I have increasingly little patience for treating catastrophic food safety failures as an unavoidable cost of doing business because producing food is complicated.
Of course producing food is complicated.
That’s why food safety costs money.
Competent food safety professionals cost money. Meaningful supplier verification costs money. Agricultural water controls cost money. Environmental monitoring costs money. Testing costs money. Sanitation costs money. Training costs money. Qualified auditors cost money. Investigating something that doesn’t look right costs money. Rejecting a supplier costs money. Holding product costs money. Slowing production costs money. And stopping production when something looks wrong can cost a shitload of money.
You know what else costs money?
Making people sick.
The difference is that corporations don’t necessarily absorb all of those costs. Consumers do. Families do. Employees who miss work do. Healthcare systems do. And sometimes people pay a price that can’t be entered into anybody’s quarterly earnings report.
I’m not saying corporate greed caused Cyclospora to contaminate this lettuce. FDA’s investigation is continuing, and we don’t yet have a final determination of exactly how the contamination occurred. I’m a scientist. I’m not going to manufacture root cause as a response to anger.
But I absolutely am asking why food supply chains involving companies with resources measured in the billions continue experiencing catastrophic failures of prevention, and whether the financial incentives throughout our industry actually match all the nice things corporations say about food safety being their highest priority.
Because if food safety really is the highest priority, eventually the outcomes need to reflect that. And in 2026, with more food safety regulations, certifications, audits, dashboards, data and technology than at any point in human history, we’re still talking about failures in basic food safety and hygiene. I get better service from the taco cart down my block, and that is NOT A JOKE!
We’ve Been Here Before
What makes the 2026 outbreak particularly difficult for me to dismiss as simply another unfortunate event is that Taylor Farms de Mexico and Cyclospora aren’t strangers.
Back in 2013, epidemiologic and traceback investigations by Iowa, Nebraska, CDC and FDA linked salad mix supplied by Taylor Farms de Mexico to Cyclospora illnesses associated with Olive Garden and Red Lobster restaurants in Iowa and Nebraska. FDA subsequently conducted an environmental assessment involving the Taylor Farms de Mexico processing facility in Doctor Mora, Guanajuato, and several ranches in the region.
That was thirteen years ago.
Then, in 2024, we had Taylor Farms-supplied onions identified through epidemiologic and traceback evidence as the likely source of the McDonald’s E. coli O157:H7 outbreak.
Now it’s 2026 and we’re back at Taylor Farms de Mexico, back in produce, and back talking about Cyclospora.
Only this time we’re talking about nearly 13,000 reported illnesses.
I don’t know everything Taylor Farms learned after 2013. I don’t know everything its customers required afterward, what changed operationally, what verification activities were added, how agricultural controls evolved, or what FDA’s continuing investigation into 2026 will ultimately tell us.
Those are exactly the things I want to know.
Because at some point, we need to stop examining outbreaks exclusively as isolated events and start asking whether our food safety systems are capable of retaining institutional memory.
The recurrence of a hazard more than a decade later does not, by itself, prove negligence. It does, however, give us one hell of a reason to ask what was learned the first time and whether those lessons translated into effective prevention.
Don’t Worry, We Have an Audit
I spent years as a GFSI auditor and have conducted supplier audits for the better part of a decade, including for some of the largest companies in the food industry. I believe audits have value. I also know exactly what an audit can and cannot tell you.
Taylor Farms publicly states that its facilities operate under the FSMA Preventive Controls for Human Food Rule and meet third-party standards including SQF certification and GFSI recognition. The company says its ranches undergo annual internal and third-party GAP audits, preseason ranch inspections and preharvest lot inspections.
That’s a substantial food safety infrastructure.
And that’s precisely why this outbreak deserves scrutiny.
An audit certificate isn’t a force field around a bag of lettuce.
An audit is a tool. Supplier approval is a tool. FSVP is a tool. Testing is a tool. Traceability is a tool. A hazard analysis is a tool. None of them, individually or collectively, should become substitutes for asking whether the risks are actually being controlled.
I’ve been talking about the difference between compliance and efficacy for years because I think our industry has developed a dangerous tendency to confuse evidence that we performed a food safety activity with evidence that the activity worked.
Was the supplier approved? Check.
Was the audit current? Check.
Was the hazard analysis reviewed? Check.
Was verification performed? Check.
Was the corrective action closed? Check.
Fantastic. Everybody gets a green box on the spreadsheet.
But was the food safe?
That’s the harder question, and consumers don’t give a shit about our green boxes.
Where the Hell Was Everybody?
There’s legitimate criticism to direct toward the regulatory system here too.
According to Associated Press reporting based on FDA records, foreign FDA food inspections have declined nearly 35 percent since 2019. AP also reported that FDA’s inspection of the implicated Taylor Farms operation during this outbreak was its first visit there since 2019.
FDA and CDC publicly announced the outbreak investigation on July 16. Taylor Farms de Mexico initiated its recall on July 17. FDA announced on August 20 that it had initiated onsite inspections and sample collection at lettuce growers in Mexico.
That’s concerning.
But blaming FDA and calling it a day would be intellectually lazy, particularly for anyone who understands FSMA and FSVP.
FDA cannot stand at every farm, processing facility, loading dock and border crossing inspecting every head of lettuce before somebody eats it. Our modern food safety system deliberately distributes responsibility throughout the supply chain. Importers have foreign supplier verification responsibilities where FSVP applies. Producers have regulatory responsibilities. Buyers establish supplier requirements. Companies conduct hazard analyses and verification activities. Auditors evaluate systems. Corporate food safety departments monitor performance. Regulators provide oversight and enforcement.
So yes, I want to know where FDA was.
But I also want to know where the hell everybody else was.
What verification activities were being performed? How was Cyclospora risk evaluated? What did historical experience tell the companies involved? What did audits identify? What were customers independently verifying? What agricultural water risks were being considered? What changed after 2013? And what evidence was everyone relying upon when they concluded the risks associated with this supply chain were adequately controlled?
Maybe the answers will demonstrate that robust systems were in place and something genuinely difficult to predict occurred anyway. That’s possible. Food safety professionals should be willing to follow evidence somewhere inconvenient.
Maybe we’re going to find gaps.
Either way, I want the answers.
We Have to Stop Confusing Compliance With Prevention
The food industry has never had more food safety infrastructure.
We have FSMA, FSVP, the Produce Safety Rule, preventive controls, GFSI schemes, supplier approval programs, third-party audits, environmental monitoring, testing programs, corrective action systems, traceability requirements, risk assessments, dashboards, KPIs and enough documentation to bury a QA department alive.
And yet, 12,883 reported people still got sick.
That should make every one of us uncomfortable.
It doesn’t prove that FSMA doesn’t work, that audits don’t work or that supplier verification doesn’t work.
It should make us uncomfortable because the purpose of all these systems isn’t to generate documentation.
It’s to prevent illness.
When a failure occurs on this scale, our question can’t simply be whether everybody complied with the system. We also need to ask whether the system was effective.
Those are not the same question.
I think that’s one of the biggest problems in food safety right now. We’ve become extraordinarily sophisticated at documenting that we manage risk while sometimes losing sight of whether we’re actually managing it.
Consumers Aren’t Case Counts
There’s something else that gets lost when we write about outbreaks professionally.
Twelve thousand eight hundred eighty-three becomes a statistic. Five hundred seventy becomes another statistic.
We discuss epidemiology, traceback, recalls, root cause, corrective actions and regulatory response because that’s our job. Eventually the investigation closes, companies implement whatever corrective actions result from it, and everybody moves on to the next crisis.
The people who got sick don’t experience an outbreak as a case count.
They experience diarrhea that won’t stop. Dehydration. Pain. Emergency rooms. Hospitalization. Medical bills. Lost work. Parents trying to care for sick children. People with underlying medical conditions becoming substantially more vulnerable because something they ate made them sick.
And two deaths were reported among cases in this outbreak.
These are people.
When companies make enormous amounts of money selling food to people, protecting those people isn’t charity. It isn’t an ESG initiative. It isn’t something nice to put in the annual report.
It’s the cost of doing business.
Spend the Fucking Money
FDA’s investigation into exactly how this contamination occurred isn’t finished. When it is, I’ll read it. If the evidence contradicts something I believe today, I’ll change my position.
That’s what scientists are supposed to fucking do.
But we don’t need a final contamination mechanism to recognize nearly 13,000 reported illnesses as a massive failure of prevention. And after 2013, after the 2024 McDonald’s outbreak, and after decades of FSMA, GFSI, supplier verification and increasingly sophisticated corporate food safety programs, asking uncomfortable questions about Taylor Farms and the enormous supply chains surrounding it isn’t unfair.
It’s our job.
If corporations have billions of dollars for expansion, logistics, technology, advertising, executive compensation and shareholder returns, I don’t want to hear that meaningful food safety is too expensive.
Spend the fucking money.
Hire qualified people and listen to them. Give food safety professionals enough authority to make decisions that hurt financially when protecting consumers requires it. Verify suppliers based on actual risk rather than how neatly the documentation fits into the approval system. Investigate warning signals. Learn from previous outbreaks. And when evidence says something may be wrong, accept the financial hit before consumers are forced to accept the physical one.
We don’t need more beautiful food safety paperwork.
We need safer food.
Welcome back to the Food Safety Dumpster Fire.
Unfortunately, there’s plenty to burn.