The FDA tied shredded iceberg lettuce served at Taco Bell to 1,644 confirmed cyclosporiasis cases across five states: Indiana, Kentucky, Michigan, Ohio, and West Virginia. That is not a rumor or a vague “possible source.” It is a regulator putting a spotlight on a specific product category at a specific fast-food chain, and telling the public which ingredient to avoid while the investigation continues.

In its update, the FDA pointed to a “single supplier of iceberg lettuce from Mexico” but did not name the company at first. A person familiar with the matter told Business Insider the outbreak was linked to Taylor Farms, which supplies chain restaurants and grocery stores. Then Taylor Farms confirmed what the FDA implied: on Friday, the company said it was pulling iceberg lettuce from central Mexico “indefinitely,” after an FDA investigation found the cyclosporiasis-contaminated produce originated at one farm that supplied “less than 1%” of the US’s iceberg lettuce.

That “less than 1%” detail is where the business risk gets real, even for people who do not think about food safety every day. When contamination comes from a small fraction of supply, it can still reach millions of hands through distribution networks. Taylor Farms is one of the largest lettuce suppliers in the world, serving restaurants, fast food chains, and grocery stores. The company says it operates 30 processing facilities across North America, and it is the biggest producer of salad greens in North America, supplying Taco Bell among many others, including Chipotle and McDonald's, plus grocery partners like Costco, Walmart, and Trader Joe's.

Regulators and companies both face a brutal constraint here: cyclosporiasis is hard to traceback cleanly. The incubation period can be about a week, so by the time symptoms like watery diarrhea show up, people may not remember exactly what they ate. The CDC reports cyclospora infections have spread across 34 states since May 1. As of July 13, the agency had confirmed 1,645 cases and 141 hospitalizations, with no confirmed deaths. Michigan, already described as hard-hit, has reported more than 4,300 cases in that state alone. Michigan health authorities also said their investigation is pointing to “lettuce or salad greens” as a potential source.

This is also a seasonality story. Cyclospora thrives in summer heat, and the CDC deputy director of foodborne, waterborne, and environmental diseases, Gwen Biggerstaff, said Tuesday that cases could continue to increase possibly through the end of August, which she described as the end of the cyclosporiasis season. In plain terms for operators: even if you identify a likely source, the outbreak can keep moving because infections keep incubating and showing symptoms for days after exposure.

In the fast-food world, the response window matters as much as the technical cause. Taco Bell said on Thursday that, based on ongoing conversations with public health officials and “an abundance of caution,” it was removing potentially impacted lettuce from a supplier in select states. The affected ingredient would be “indefinitely removed from our supply chain nationwide” and replaced within 24 hours in select states. Taylor Farms added that salad kits and other produce it sells were unaffected by the iceberg lettuce contamination.

For executives on boards and in procurement, this sets up the kind of test that audits and insurance cannot fully substitute for: can your supply chain isolate an ingredient quickly enough to protect customers without shutting down the business? Taylor Farms recalled other produce in recent years, including yellow onions in 2024 over potential E. coli contamination, which the CDC said killed one person and sickened over 100 others across over a dozen states. There was also a 2020 recall involving onions sold at Kroger and Walmart over potential salmonella contamination, and a prior recall of salad kits in 2023 that did not disclose that they included soy and sesame, according to the FDA. The pattern across these events is not the same pathogen every time, but it does point to a recurring operational reality: when you are a massive aggregator of food, product risk travels with your scale.

Consumers are also getting practical, if imperfect, advice. Health experts have recommended avoiding bagged lettuce and salads until the outbreak is over, choosing whole heads of lettuce and removing the outer layer of leaves, and washing produce thoroughly. But there is “no surefire way to wash cyclospora off produce,” so the safest move is to cook foods to at least 158 degrees Fahrenheit. That matters strategically because it affects demand and how customers perceive your brand, not just how they eat. If a chain removes an ingredient quickly but the outbreak continues for weeks, regulators and customers may still associate the brand with the risk.

Finally, the investigation is ongoing, meaning other potential sources could still be identified. The FDA’s initial trace to a single supplier supplying “less than 1%” of US iceberg lettuce shows how complex outbreaks can unravel even when the first suspect looks narrow. For peers running restaurants, retail grocers, or large food manufacturing and processing networks, the lesson is straightforward: supply chain mapping has to be fast, and public-facing action has to be immediate enough to match the biology. When the CDC expects cases to rise through end of August, “we think it is handled” is not a business strategy. It is a press release waiting for reality to contradict it.