Three hundred forty-five people in 27 states have now tested positive for Salmonella linked to a single ingredient: jalapeño peppers imported from Mexico and distributed by Coast Citrus Distributors, a Southern California-based produce supplier. Thirty-six people required hospitalization. Nobody has died — yet — but the outbreak is still active, and health officials say the case count is likely an undercount, because most people with mild Salmonella infections never get tested.

The CDC and FDA have both confirmed the investigation, tracing the contamination upstream through the food-service supply chain to a specific farm in Mexico and through Coast Citrus Distributors to restaurant customers including Chipotle Mexican Grill and QDOBA. Coast Citrus has issued a recall of the affected peppers. The two chains have pulled jalapeños from their menus at implicated locations, but the distribution footprint of a single mid-size produce supplier reaching two of the most ubiquitous fast-casual chains in North America tells you something about how concentrated — and how fragile — that supply chain actually is.

What the official statements don't dwell on is the timing gap. According to CDC illness onset data, people began getting sick weeks before the public recall. That is not unusual in foodborne outbreak investigations — the agency needs epidemiological clustering and laboratory confirmation before it can act — but it means a predictable window during which contaminated product kept moving and consumers kept eating. Every foodborne outbreak of this type has that window. The question the industry never seriously answers is how to close it.

Salmonella is not an exotic pathogen. It is one of the most common causes of foodborne illness in the United States, responsible for roughly 1.35 million infections, 26,500 hospitalizations, and 420 deaths annually, according to CDC baseline estimates. Fresh produce — particularly items that are eaten raw or minimally processed, like jalapeños used as a topping — is a well-documented vehicle. The contamination pathway is usually irrigation water, animal intrusion near growing fields, or handling during harvest and packing. None of these are new problems. All of them are addressable.

The Mexico-to-U.S. produce pipeline is enormous and structurally difficult to surveil. Mexico is the largest single source of imported fresh vegetables entering the United States, and FDA inspection resources at the border are not calibrated to the volume. The agency's Foreign Supplier Verification Program, established under the Food Safety Modernization Act, places the burden on U.S. importers — companies like Coast Citrus — to verify that their foreign suppliers are meeting food safety standards equivalent to domestic requirements. Whether that verification is rigorous in practice, or whether it amounts to paperwork compliance, varies by company and is rarely tested until someone ends up in an emergency room.

At least one lawsuit has already been filed. A Minnesota woman who was hospitalized with sepsis — a life-threatening systemic infection that can develop when Salmonella enters the bloodstream — has sued Chipotle, alleging negligence in its sourcing and quality-control practices. Chipotle has not publicly commented on the litigation. The suit is notable because it names the restaurant chain directly rather than only the distributor or the farm, which is the legal theory that tends to force corporate supply-chain accountability into public record through the discovery process.

Colorado and North Carolina are among the states reporting clusters of cases, with Colorado's concentration drawing particular attention given the density of Chipotle and QDOBA locations — both chains have strong footprints in that market. The geographic spread across 27 states, however, reflects the national distribution reach of a single mid-tier supplier, not any regional peculiarity. That is the architecture of modern food distribution: one contaminated pallet, efficiently shipped, becomes a 27-state problem in days.

The CDC is advising consumers who purchased jalapeños from affected lots to discard them and for anyone who ate at implicated locations and developed diarrhea, fever, or abdominal cramps within 12 to 72 hours to contact a healthcare provider. The investigation remains open. What will not remain open, once the case count stops climbing and the news cycle moves on, is the harder conversation about whether voluntary supplier verification and post-outbreak recalls are an adequate food safety architecture for a supply chain operating at continental scale. They have never been. This outbreak is not an anomaly — it is a recurring demonstration of a system working exactly as designed, and exactly as badly as critics have long argued.