On October 2, 2026, FDA closed its investigation of the largest multistate Cyclospora outbreak on record. FDA said the two positive environmental samples – one from a tank of outgoing wastewater at the Taylor Farms de Mexico processing plant, one from a drainage ditch at a grower in the traceback – add to the strong epidemiological data and traceback convergence supporting the link to the recalled iceberg lettuce.

No lettuce tested positive. Taylor Farms has made that its point. Its Cyclospora information hub stresses the absence of a positive product sample, even as it says it stands behind the decision to recall.

That argument has surface appeal. It borrows the vocabulary of laboratory proof. And it asks for a standard that no public health agency in this country uses.

What an outbreak link is built on

Investigators use three kinds of evidence: epidemiology, traceback, and food or environmental testing. CDC’s published investigation steps say that when food eaten by several sick people shares a common point in the supply chain, that convergence can confirm the food is the source. Finding the strain in a food can “also” confirm it. Also – not only.

CDC goes further. Officials can act on strong epidemiological evidence alone and do not have to wait on a laboratory to find the outbreak strain in the food. And CDC says the reverse is true too: finding the strain in a food cannot by itself confirm the source unless interviews show sick people ate it.

CDC’s Field Epidemiology Manual puts it in training terms. Investigators generally identify the likely source when two of the three lines of evidence are clear and convincing. For short shelf-life foods – the manual uses leafy greens as its example – testing may be impossible, so investigators rely on the other two. And a negative result does not rule a food out.

USDA’s Food Safety and Inspection Service defines an implicated product the same way: strong evidence from two of the three sources. The CIFOR guidelines, written by the state epidemiologists, local health departments and public health labs with CDC, FDA and USDA, tell investigators to pull a food when exposure data link it to illness even if the pathogen has not been isolated from the food.

Why the lettuce is never there to test

The lettuce that made people sick was eaten three or four weeks before anyone knew there was an outbreak. That is CDC’s own reporting lag. What gets tested is what is left – which is, by definition, other lettuce.

And contamination is sparse and uneven. Do the arithmetic. If one head in a hundred is contaminated and you test sixty with a perfect test, every result comes back negative 55 percent of the time. At one in a thousand, 94 percent. For Cyclospora, which cannot be cultured and is hard to detect on produce at all, the test is far from perfect.

In FDA’s fall 2019 romaine investigation, teams took 406 sub-samples across Salinas Valley farms. One matched. The only product positives came from two intact packages sitting in sick people’s refrigerators. That is how product positives happen – luck, not systematic testing.

The industry has said this itself

Here is where the defense runs into its own allies. Western Growers told growers this July that testing for Cyclospora is not recommended because of sampling and technological limits that may give a false sense of security. The California and Arizona Leafy Greens Marketing Agreements opened their 2026 webinar with “Testing is not the answer.”

The International Fresh Produce Association’s own 2026 outbreak FAQ says the recall and the outbreak findings rested on epidemiology and traceback, not on a positive lab test, and that the absence of a positive sample did not mean those findings were wrong.

In November 2018, with no grower, processor or brand identified and no romaine positive, the produce industry urged a halt to all romaine shipments. That was the industry acting on epidemiology alone. It was right to.

The record

The 2018 Yuma romaine outbreak – 210 sick, five dead – was solved without a single positive head of romaine; the strain turned up in canal water. In 2013, Nebraska and Iowa traced a Cyclospora outbreak to salad mix from Taylor Farms de Mexico on interviews and records, with no product positive. Taylor Farms suspended production on that evidence. Same company, same kind of proof, thirteen years ago.

In 2011, Germany stopped an E. coli O104:H4 outbreak that sickened more than 3,800 people by implicating sprouts on a case-control study, a restaurant cohort and product tracing. As a 2025 Eurosurveillance perspective put it, laboratory evidence is neither sufficient on its own nor a prerequisite for action.

Closer to home, after a negative lettuce test in the November 2024 St. Louis outbreak, the county health department said plainly that a negative result did not rule out the salad. The epidemiology was the most compelling evidence.

What the argument really asks for

Take the “nothing tested positive” defense seriously and follow it to the end. The implicated product is almost always gone. Produce testing is insensitive. Some pathogens cannot be cultured at all. A rule that no company is the source until its product tests positive is a rule under which no produce outbreak could ever be attributed to anyone.

That is not a standard of proof. It is a standard of immunity. CDC, FDA, USDA, CIFOR, Western Growers, the LGMAs and IFPA have each rejected it in writing.