Cyclospora, iceberg lettuce, and the traceback the lab test couldn't do: an FSMA 204 teardown for leafy-greens producers

Right now FDA and CDC are working a live one, and it is a leafy-greens story from start to finish.

A multistate outbreak of Cyclospora tied to iceberg lettuce served at Taco Bell locations has sickened 1,947 people across nine states, with at least 98 hospitalizations and no deaths reported, and illness onset dates running from June 22 to July 20, 2026. On July 17, Taylor Farms de Mexico recalled all iceberg lettuce sourced from central Mexico, product whose confirmed distribution now covers 28 states.

Updated July 28. When this post first ran on July 24 the outbreak stood at 1,644 cases across five states. FDA has since added Illinois, Kansas, Oklahoma, and Pennsylvania, bringing the count to 1,947 across nine. Worth noting why the number is still climbing after a recall: FDA says it can take as long as six weeks for CDC and state officials to determine whether a sick person belongs to an outbreak. The investigation window stays open long after the news cycle closes, which is the whole reason your records need to be able to bound your exposure on demand rather than eventually.

I am not going to dwell on the human cost beyond naming it: thousands of people got sick, ninety-plus landed in a hospital bed, and the point of a traceback is to shorten the days between the first sick person and the last contaminated bag. What I want to sit with is the one detail in this outbreak that should stop every leafy-greens producer cold.

The lab test failed, and the records still caught it

A lettuce sample in this investigation first tested positive for Cyclospora. Then FDA's laboratory experts re-reviewed it and concluded the result was a false positive. As of July 19, there were no confirmed positive product samples at all. Cyclospora is notoriously difficult to detect in food.

Read that again. There was no clean lab hit tying the lettuce to the parasite. And FDA still found the source. It worked backward through distribution records and patient interviews until the trail converged on a single supplier, Taylor Farms de Mexico, that had provided the shredded iceberg used at the restaurants where sick people ate.

That is the whole argument for traceability in one outbreak. Testing is a spot check that gives you a maybe. When it comes back a false positive, or a false negative, or nothing at all, the thing that actually resolves the outbreak is the paper trail: who shipped which lot, where it went, and what went into it. Records are the control that keeps working when the lab does not.

If you grow, cool, pack, cut, or ship leafy greens, the second thing to sit with is that leafy greens, including fresh-cut leafy greens, are on FDA's Food Traceability List. That means FSMA 204 applies to you. The compliance deadline moved to July 20, 2028, but the traceback in the news happened in July 2026, and the suppliers in that chain were expected to produce records regardless of the deadline. An outbreak does not check your calendar, and neither does a buyer.

So let us do the thing nobody publishes. Instead of another explainer, here is the exact traceback that cracked this outbreak, run against a small operation the way it would actually land on your desk. We watch it fail. Then we fix the four things that broke it and watch it pass.

The setup

Meet Cedar Furrow Farms, a fictional grower-packer of about fifteen acres of leafy greens. Two families, a wash line, a small cold room, and a bagging machine. Cedar Furrow does the whole chain in one yard:

• It harvests romaine and green-leaf from several fields across the week.
• It cools the harvested greens in a small hydrocooler before packing.
• It initially packs some whole heads for a couple of grocery accounts. This is where the Traceability Lot Code gets assigned for the raw commodity.
• It fresh-cuts the rest: chopped romaine, bagged and dated. This is the one transformation event in the operation, and it earns a brand-new Traceability Lot Code.
• It ships bagged chopped romaine to one regional foodservice distributor and whole heads to two grocery accounts.

The lot at the center of the drill is the chopped romaine bagged on Tuesday, June 30, under lot CR-20260630-002. That is exactly the kind of product, a fresh-cut leafy green heading into foodservice, that the Cyclospora chain was built on. When an outbreak signal points at chopped lettuce, Cedar Furrow is a supplier a distributor traces back to.

Set a 24-hour timer. The clock starts.

Hour 0: the request lands

Cedar Furrow does not get an email from FDA. Small suppliers almost never do. The request comes from the distributor, forwarding pressure from above: there is an illness signal on chopped romaine, and the distributor needs to know every lot Cedar Furrow shipped in a defined window, where it came from, and what fields fed it. It wants the answer as one sortable spreadsheet, and it wants it fast, because the distributor is on its own clock with the retailer or the agency above it.

This is the same mechanic FDA used in its 2026 traceability readiness tabletop exercises: locate the records for a specific product over a defined date range and deliver them in an electronic sortable spreadsheet within 24 hours. In those exercises the request started downstream and worked upstream, supplier by supplier, until it reached the firm that first assigned the Traceability Lot Code. For chopped romaine, Cedar Furrow is that firm. It is the transformation point and the TLC source. When the trail runs back to its origin, it stops in this yard.

One owner starts pulling harvest and pack records. Another pulls shipping. The timer reads 24:00.

Hours 1 to 4: which field grew it? (break point 1)

First question from the distributor: the chopped romaine lot that shipped on July 1, which field did it come from?

Cedar Furrow harvested romaine that week from three different blocks: the north field on Monday, the creek field on Tuesday morning, the road field on Tuesday afternoon. All three got cooled together and staged in the same cold room. On Tuesday the fresh-cut line ran a batch of chopped romaine and bagged it as CR-20260630-002.

The harvest crew wrote field and date on a clipboard tag that rode the bins to the cold room. But when the fresh-cut line pulled greens to chop, it pulled from whatever was staged and ready. Nobody recorded which field bins fed which bagging run. The bag lot code says "chopped romaine, June 30." The harvest tags say three fields over two days. There is no link between them.

This is break point 1: commingled harvest with no field lot carried onto the finished lot. Cedar Furrow can tell the distributor the romaine came from one of three fields. It cannot say which. That ambiguity is exactly what lets a leafy-greens outbreak keep spreading while investigators try to narrow the source, and it is the single hardest thing about leafy-greens traceability. In the real Cyclospora investigation, the whole game was converging on one source instead of a suspect list. A traceback that can only offer a suspect list has already lost the day.

Hours 4 to 8: the lot code with no parent (break point 2)

Next: prove what went into CR-20260630-002.

The bag lot code was printed from the bagging machine's own label template. It is a clean, well-formed code. But it was never written back onto the fresh-cut production record, and the fresh-cut production record never listed the input harvest lots by their codes. The transformation happened. The new Traceability Lot Code was assigned. But the link from the new code back to its parent lots was never captured at the event.

This is break point 2: no Traceability Lot Code source captured at the transformation. The finished bag has a code; the record that proves what the code is made of does not reference it. This was the most common gap FDA found in its tabletop exercises. Only 40 percent of participants captured a properly assigned Traceability Lot Code across every Critical Tracking Event they performed. If the difference between a TLC, a KDE, and a CTE is still fuzzy, that primer untangles it. The short version: transformation is a Critical Tracking Event, and linking the new lot code to its inputs is a Key Data Element you capture at that event, not reconstruct from a label a week later.

Hours 8 to 16: two systems, no shared key (break point 3)

Now assemble the shipping side. Who received CR-20260630-002, how much, and when?

Cedar Furrow logs production on the wash-line clipboard and in a spreadsheet the packing lead keeps. Shipping lives somewhere else entirely: the invoices in the accounting software the office runs. The invoice to the distributor says "chopped romaine, 40 cases, July 1." It does not carry the lot code. The accounting system was never set up to hold one.

So to answer "who got this specific lot," someone has to eyeball the production spreadsheet, guess which pack run the July 1 invoice drew from, and hope the dates line up. On a busy week with two bagging runs a day, that guess is not a record. It is a story.

This is break point 3: production and shipping in two systems that do not share a key. The lot code is the key. If it lives on the pack record but not the invoice, the two halves of your traceback cannot be joined, and the one-step-forward answer becomes an educated guess. FDA's whole method in the Cyclospora outbreak was joining distribution records into a chain. If your own two records will not join to each other, you cannot even hand over a clean link.

Hours 16 to 24: the missing origin (break point 4)

Last, the distributor wants the origin details: where was this romaine grown, and when was it harvested? Those origination Key Data Elements, the growing area and the harvest date, are what let an investigator draw a circle on a map and check it against weather, water, and neighboring farms. In a Cyclospora case, which is a fecal-oral parasite tied to contaminated water and produce, the growing area is not a nice-to-have. It is the lead.

Cedar Furrow has this information. It is on the harvest clipboard tags. But because of break point 1, those tags were never tied to the finished lot, so the origin data cannot be attached to the answer with any confidence. The record exists and is useless, which is the most frustrating failure of all: you did the work and still cannot prove it.

The timer hits zero. Cedar Furrow can produce a pile of true documents and cannot assemble them into one sortable spreadsheet that traces CR-20260630-002 one step back to a field and one step forward to a customer. Under a real request, that is a fail.

The re-run that passes

None of the four break points is a technology problem. Each is a habit. Fix them and re-run the same drill:

1. Carry the harvest lot into the pack run. When the fresh-cut line pulls greens, it records which field or harvest lots fed the batch. Commingling is fine as long as the blend is written down. Now the finished lot points back at a specific set of fields, not a shrug.
2. Write the new Traceability Lot Code onto the transformation record, with its inputs. One row: this finished lot code, these input harvest lots, this date, this location. The worked fresh-cut-greens example shows the exact format and where the code has to travel.
3. Put the lot code on the shipping record. The invoice, the packing slip, or the shipping log carries the same code the pack record carries. One shared key, and the two halves of the traceback join with a filter instead of a guess.
4. Keep the origination KDEs attached. Growing area and harvest date ride with the lot from the field all the way to the ship record, because step 1 kept the link intact.

Run the timer again on a fixed operation and the whole thing collapses to a two-minute export: filter to CR-20260630-002, and it resolves to three named fields with harvest dates on one side and one distributor with a case count and date on the other. That is the difference between a supplier a distributor keeps and a supplier a distributor drops.

Why the lab result is a warning, not a comfort

Come back to the detail we started with. In this outbreak the lettuce sample was a false positive, and there were no confirmed positive product samples, yet the source was still identified. Cyclospora hides from the lab.

For a producer, that cuts both ways and both ways are uncomfortable. A clean lab test on your product does not clear you, because the pathogen may simply be undetectable in the sample you pulled. And a positive test somewhere in the chain does not automatically move blame elsewhere, because it might not hold up on re-review. The only thing that consistently resolves who is and is not implicated is the traceback: the records that prove where a lot came from and where it went. When you cannot lean on a lab result, records are all that is left, and they are enough only if they are clean.

That is the quiet message of this outbreak for anyone handling leafy greens. Your defense is not a certificate of analysis. It is whether you can answer the traceback in a day.

Run this drill yourself

You do not need our permission or our product to do this. Do it this week:

1. Pick one finished lot you actually shipped in the last month. A real one, not your cleanest one. If you fresh-cut, pick a transformed lot, because that is where the link breaks.
2. Set a timer for 24 hours on paper, or be honest and give yourself the 2 to 4 hours a program like Costco expects if you sell into one that enforces it.
3. Produce two things from that one lot code, as one sortable spreadsheet: every harvest or input lot that fed it with its field and date (one step back), and every customer who received it with quantities and dates (one step forward).
4. Write down where it broke. It will break at one of the four points above. That break point is your next fix, and it is worth more than any audit certificate, because you found it before an outbreak or a buyer did.

Do it once or twice a year at minimum, and again every time you add a field, a product, a customer, or change the software you log things in. Retailer and distributor programs, from the Whole Foods supplier audit on down, will ask for the documented result, and the untimed version does not count.

Where FSMA204Hub fits

Everything above is doable in a spreadsheet if you have the discipline to keep the lot code on every record and never let harvest, packing, and shipping drift into three systems that do not share a key. That discipline is exactly what breaks under a real deadline, which is why the drill fails at hour zero and not hour twenty.

That is the bet behind FSMA204Hub: one place where each finished lot is a row, the input harvest lots and the customers hang off the same lot code, and the answer to "trace this lot both directions" is a filter and an export, not a 24-hour scramble. The compliance score on the dashboard answers the one question a traceback really asks: can you prove, right now, where your lots came from and where they went? Green means the request is a two-minute export. Amber tells you which link to fix before an outbreak or a buyer makes you find out the hard way.

If a Cyclospora recall in the news just made this feel less academic, take the free score and see where your leafy-greens records would break. It takes a few minutes and no credit card.

---

Ran the drill this week and hit a break point you cannot fix? Reply to our newsletter or email [email protected] and tell me which of the four points it broke at. I will tell you the cheapest fix for your setup.

Further reading

• FDA: Investigation of 9-State Outbreak of Cyclospora Illnesses: Iceberg Lettuce (July 2026)
• CDC: Cyclospora Outbreak Linked to Iceberg Lettuce in 5 States
• FDA: Food Traceability List
• FDA: Food Traceability Final Rule overview

Related on this site

• The 24-hour traceback drill: an hour-by-hour FSMA 204 mock recall
• How to assign a Traceability Lot Code: chevre, almond butter, and fresh-cut greens
• TLC vs. KDE vs. CTE: the three FSMA 204 concepts producers keep mixing up
• The FSMA 204 KDE checklist: what to capture at receiving, transformation, and shipping
• What your retailer's FSMA 204 questionnaire is asking for

Written by Anas Marwan, Co-founder of Darza Technologies. Last reviewed 2026-07-24.