The United States is in the midst of the largest recorded outbreak of cyclosporiasis in its history: 6,707 laboratory-confirmed cases since 1 May, more than 11,500 additional cases under investigation, and a multistate outbreak spanning nine states.
The contamination event may not have been wholly preventable. Its scale was, and that makes this a hard test of where food businesses have chosen to invest in risk.
The question I have been often asked over the past few weeks is whether this outbreak could have been prevented. I have worked in this industry for a long time, and my answer is its unlikely. Whilst I have no doubt that there would have been control measures in place for microbiological contaminates, Cyclospora cayetanensis is, however, a unique case. I also think prevention is the less important question. The one I keep returning to after tracking public reporting is ‘how produce from a single independent farm, representing less than 1% of US iceberg lettuce supply, can have such a widespread foodborne illness impact, both in scale and duration?’ And the answer to that question lies in what happened between the field and the consumer, and in how long it took anyone to notice.
Why this organism defeats the routine playbook
Cyclospora cayetanensis is a parasite. It is neither a bacterium nor a virus, and the day-to-day rhythm of testing and monitoring in a processing environment is built around those two. It reaches food through contamination with human faeces, most often via irrigation or wash water, and it does not multiply in the product. It multiplies in the person. It sits in the folds of a leafy green, entirely inert, until it is consumed.
The operational consequence follows from that biology. Environmental monitoring programmes are built around bacterial hazards and will not identify it. Routine microbiological testing of produce will not identify it either. Specialist molecular methods exist and have a role in outbreak investigation, but they are slow and technically demanding rather than practical production controls. A lettuce sample reported as positive during this outbreak was later identified as a false positive - highlighting the complexity.
So a business can be running a well-designed, certified food safety management system, generating clean results every day, and still be shipping affected product. That is not a shortcoming of the management system, and it is not an argument against certification: certification confirms that a system controls the hazards it has been designed and validated to control. It is an argument for knowing where the edges of your own controls sit and having the insight to understand when something has changed that may exceed the established boundaries of control.
The amber flags nobody was looking for
As routine microbiological monitoring procedures cannot readily confirm the presence of this organism, the useful signals of potential contamination must extend to both the growing region and processing conditions, namely:
- Surface water quality trends across the catchment feeding the irrigation source, tracked as a direction of travel rather than a pass or fail on the day of sampling.
- Rainfall and storm activity upstream of that source. Heavy rain mobilises whatever is in the surrounding environment.
- Ambient temperature against baseline. As temperatures rise, surface water quality falls, which is why this is a summer organism in the northern hemisphere.
- Regional outbreak history. Cyclospora has a documented association with leafy green produce categories and sourcing regions over many years, and that history is public.
- Your own change events. A new grower, a new field, a spot purchase to cover volume, a supplier brought in outside the approved programme.
- Your own operating data. Throughput against baseline, line hours between teardowns, deferred maintenance during a seasonal peak.
None of the above reflect common food safety monitoring controls, which is why they tend to sit unused: in procurement, in operations, in meteorological and public health data sets, and in very few food safety decision processes. Individually none would have identified contamination. Collectively they would have raised a question, in a specific region, before the product shipped. That is not prevention. It is earlier suspicion, and earlier suspicion is worth a great deal in a supply chain moving perishable product at volume. Something did change here. Something always does. The question is whether anyone was positioned to see it.
Convenience changed the risk profile faster than the models did
So how did a contamination event of the reported size become an outbreak of this scale? Consumers have become accustomed to washed, shredded, ready-to-use produce and the sector delivered it well. But the shift changed something fundamental: the maximum size a single contamination event can reach.
A whole head of iceberg lettuce sold to a consumer is one unit of risk. The same head through a shredder becomes hundreds of units distributed across multiple states. At seasonal peak there is more product moving through production with less room for downtime. Couple this with cleaning and sanitation protocols validated using known biological indicators, is it any wonder that the contamination went so long undetected given the characteristics of Cyclospora.
Whilst the methods employed for hazard analysis under the principles of HACCP include consideration of likelihood, the relationship between processing intensity and outbreak scale should also be explicit for every value-added food product, and in my experience, it is often implicit at best.
Containment is where the gains are
This outbreak had a clear epicentre in a single state, in perishable product with a short shelf life. Cases still spread across nine states while the traceback ran. Every hour between a cluster appearing in the data and affected product being located and stopped is measured in cases. That is not a prevention problem. It is a containment problem, and containment responds well to investment.
One step up and one step back has been the sector's working definition of traceability for decades. It has been recognised that in the 2020s this is not good enough. A manufacturer needs visibility back to origin, at lot level, retrievable in hours rather than weeks. Nothing else available to a food business reduces impact as effectively.
Whilst both independent standards, and regulations, e.g. FSMA Section 204 and The Food Traceability Rule, set out the clear requirements for demonstratable transparency in end-to-end traceability for high-risk products, this is not a matter of compliance. It is a matter of consumer safety and having the confidence that the systems in place will deliver when they are needed.
The ratio of investment is wrong
None of this suggests food safety management is failing. WHO's latest estimates show the global burden of foodborne illness has fallen since 2000. That reflects an enormous amount of coordinated effort across government, industry and science, and standards, management systems and independent assessment are how much of the industry's contribution has been organised and verified. This is a sector that updates its standards as the evidence moves. The frameworks are not the gap.
What I would question is the ratio of investment. Food businesses are now substantially investing in AI and risk intelligence solutions, largely against an implicit promise of prevention: this is the wrong benchmark, and holding these tools to it does them a disservice. The two points in this outbreak where better data would have made a material difference were earlier suspicion of upstream risk, and faster product identification once people were ill. One buys time before product ships. The other limits how far it travels. Neither is the guarantee being sold by the countless solutions on offer.
Comparatively, little time and effort is taken to look deeper into the factors that contribute to how large an event becomes once something has gone wrong, such as:
- Consideration of risk signals due to change from across the geographic and broader business landscape
- Honest hazard analysis of processing intensity
- Tested traceability systems that extend to point of origin, capable of performing fast enough to matter on the day they are needed
The opportunity hidden in every outbreak
The impact of this outbreak continues to grow with the recent confirmation of two deaths. From all public reports to date the early lessons to be learnt are clear: strengthen visibility beyond traditional food safety measures, challenge assumptions about processing and distribution risk and ensure traceability systems are fast enough to support action when every hour counts.
It is not so much the risk. It is the impact of the risk, and how much of that impact you are able to contain.
What distinguishes the organisations that emerge from an incident with minimal consumer harm and reputational damage is not that they prevented the event entirely, but that they recognised risk sooner, understood its potential impact and acted decisively to contain it.
With more than 40 years of sector expertise, LRQA is the trusted global risk management partner to the food and beverage sector. Delivering innovative solutions across the full value chain - from farms and manufacturers to retailers and restaurant brands - we help organisations move beyond compliance to manage what matters most.
