The 2026 Jalapeño Recall: One Lot, Eighty Products, Five Companies

A single grower’s contaminated jalapeño lot did not stay a jalapeño. It became salsa, pico de gallo, guacamole, soup mix, stuffed mushrooms and salad dressing, sold under a dozen different brands by five companies with no relationship to one another. Each had to independently work out whether its own products contained it - and the count wasn’t even final when we sat down to write about it.

As of FDA’s August 21, 2026 update, 431 people across 32 states have been confirmed infected with the outbreak strain of Salmonella Javiana, with 57 hospitalizations and zero deaths. Illness onsets run from June 19 through August 2. Of 224 people interviewed, 203 - 91% - reported eating at a Mexican-style restaurant, including Chipotle Mexican Grill and QDOBA.

FDA’s traceback pointed to a single common grower in Sinaloa, Mexico, supplying fresh jalapeños to Coast Citrus Distributors. FDA recommended a recall; Coast Citrus agreed, first issuing a limited recall on July 22 and then, on August 5, agreeing to recall all remaining jalapeños from that grower. Chipotle switched suppliers for affected stores on July 20; QDOBA stopped using jalapeños entirely on July 28. FDA says it does not consider there to be ongoing risk from those restaurants.

That much is a recognizable outbreak story: a grower, an importer, a recall. What makes this one different from a typical produce recall is what happened after Coast Citrus stopped shipping.

One importer, five unrelated recalls

Coast Citrus doesn’t sell jalapeños to consumers. It sells them to other companies, who use them as an ingredient. Once the recalled peppers left Coast Citrus, they went into finished products made by companies that, as far as the public record shows, have no relationship to each other beyond having bought from the same importer during the same window.

Five separate recalls resulted:

That’s roughly eighty individually recalled finished products - by FDA’s own count across the five notices - made by five companies, none of which grew, imported or sold the pepper itself. On top of that, FSIS issued a public health alert on August 8 for meat and poultry products containing the same recalled jalapeños, sold across ten retailers in 22 states - which means the contamination crossed from FDA’s jurisdiction into USDA’s. Two federal agencies, five companies, one pepper.

The data existed. It just wasn’t reachable.

Look at what the downstream recall notices actually publish. Hardie’s lists seven specific lot codes - X2741775, X2741859, X2744163, X2744706, X2746349, X2746490, X2748743 - tied to five production dates. NatureBest’s notice lists a lot-code range, 190A26184 through 190A26216, against specific UPCs for its soup mix and pico de gallo lines. Each of the other three downstream notices lists a comparable set of specific UPCs, best-by dates or lot codes for its own recalled products.

That is GTIN, lot and date data - the same fields a GS1 Digital Link encodes as Application Identifiers 01, 10 and 15 - rendered as an HTML table on a government website instead of encoded on the package. The information was not missing. It was published, in exacting detail, by five different companies within days of each other. It just existed nowhere a scanner, a register or an inventory system could read it. A person had to find the notice, read the table, and manually check it against what was in a warehouse or a fridge.

That’s the same “it was already ink” argument we made about July’s lettuce recall - and it’s real here too. But it is not the hard part of this story, and building this piece around it would blur two genuinely different problems. The lettuce recall was about scoping at the source: one supplier couldn’t prove which of its own lots were implicated, so the recall covered an entire growing region instead of a specific batch. This one is about something that happens one step further downstream, after the source is already known.

Knowing the source lot doesn’t tell you where it went

Here is the part that a lot code alone cannot solve, no matter how well it’s printed or encoded.

Say every case of jalapeños Coast Citrus shipped carried a GS1 Digital Link with the grower’s lot number on it - AI 10, exactly the fix the lettuce piece calls for. That tells a receiving company “this case belongs to lot 4471.” It does not tell anyone that lot 4471 went into batch 190A26197 of somebody’s pico de gallo, or that a case of it got portioned into forty cases of somebody else’s salsa. The identity of an ingredient and the identity of what it becomes are two different facts, and a lot number on the ingredient’s own label only ever answers the first one.

FDA’s own advisory says this plainly, twice. To anyone still holding recalled jalapeños:

“If you cannot tell where your jalapeño peppers came from, you should work with your supplier to determine their source and discard the product.”

And, pointed squarely at every company that bought them:

“Manufacturers who may have used recalled jalapeños to create new products should consider if they need to initiate a recall and contact their FDA recall coordinator.”

Read that second sentence again. The federal food safety regulator is telling manufacturers to consider whether they’re implicated - not confirming it, not querying it, asking them to go check. That is not a gap in enforcement. It’s an honest description of the only tool available: each company reads an advisory naming an importer and a grower, then goes and manually reconciles it against its own receiving records, one shipment at a time.

What a transformation event actually captures

This is where GS1’s EPCIS standard has a purpose-built answer, and it’s a different one from lot-scoped identity on a single product.

A transformation event records that specific input lots became specific output lots - not “this case has a lot number,” but “these five cases of lot 4471 jalapeños, plus these other ingredients, were combined at this facility on this date into two hundred cases of pico de gallo lot 190A26197.” Captured at every point an ingredient gets repacked, blended or turned into something else, a chain of transformation events lets you ask a question none of the individual lot numbers can answer on their own: given a contaminated input lot, which output lots contain it?

With that chain in place, “which of my finished goods contain the recalled pepper lot” stops being a question five companies each answer by hand from a government press release. It becomes a query against each company’s own records, answerable in the time it takes to run it, the moment Coast Citrus’s recall lands. Without those events captured, it’s what actually happened here: five companies, working from the same public advisory, each reconstructing by hand which of their own products might contain an ingredient they can no longer fully trace.

Two different fixes for two different points in the chain

It’s worth being precise about what solves what, because it’s tempting to treat “better traceability” as one fix and this outbreak proves it isn’t.

Lot-level identity on the package - AI 10, the fix at the center of the lettuce recall piece - answers “which of this product is affected.” It’s necessary, and this outbreak needed it too: without lot codes on the jalapeños in the first place, none of the five downstream companies would have had anything to check their receiving records against at all.

But lot identity on an ingredient doesn’t propagate through a recipe by itself. Once a lot of peppers gets diced into a hundred cases of pico de gallo, the pepper’s lot number doesn’t travel with it unless something explicitly records that link. That’s what a transformation event is for. One is about identifying a unit. The other is about tracing what a unit became. This outbreak needed both, and the industry-wide default today has neither.

The unglamorous part: this already works

None of this is speculative. Recording a transformation event - input lots in, output lots out - is a standard, implementable step in a production line that already tracks lots for its own inventory and quality records. It doesn’t require serializing individual jalapeños or predicting which products will eventually need a recall. It requires recording, at the moment of manufacture, what went into what - the same record a food safety team already keeps for an internal audit, made queryable instead of filed away.

It’s also not just a proposal on our end. This is the same GS1 EPCIS standard behind FDA’s own Food Traceability Rule (FSMA 204), which will require exactly this kind of recordkeeping - tied to a common lot code, at every point a product changes hands or changes form - for foods including jalapeños, once compliance is required in 2028. Closient’s platform already captures these events as they happen and can generate the FDA-format traceability export a company would need to hand over in an actual recall, for any lot, on demand.

The alternative is what happened this August: a federal advisory naming a grower and an importer, and company after company independently reading it, reconciling it against paper and spreadsheets, and hoping they’d caught everything before FDA posted another notice.

This piece was drafted around four companies. A fact-check against FDA’s own site turned up a fifth: Salata Dressings, a single Jalapeño Avocado Dressing sold at Texas H-E-B stores, recalled August 11 - inside the same window as the other four, but easy to miss by hand until FDA published a consolidated tracking page for the whole outbreak on August 20. Nothing about that recall was hidden. It was public the entire time. It just wasn’t findable as part of the same story until someone built the index - which is exactly the gap a transformation-event chain closes automatically, and manual recall-notice-reading does not. That’s not a footnote to this piece’s argument. It is this piece’s argument, demonstrated on itself before publication.

All figures in this post are attributed to FDA, CDC or FSIS and are current as of August 21-24, 2026. Recall counts and the list of affected companies have changed multiple times since the outbreak was first announced and may change again; check the linked primary sources for current numbers before relying on any of them.