The moment Chipotle Mexican Grill Inc. figured out it was the jalapeños, its automated recall system began calling restaurants, again and again and again.

With diners falling ill with salmonella across the country, Chipotle kept at it, flooding its stores with alerts until someone responded and confirmed the tainted peppers had been destroyed. This was while health agencies were still investigating a handful of ingredients as the potential source. They’d sent the company a “guac signal,” warning there was trouble with something in the guacamole.

But it was Chipotle that narrowed it down to the jalapeños first — days before authorities announced nationwide recalls last week. After pulling the jalapeños from affected locations, the chain quickly replaced them with batches from different growers. The company had prepared for this very scenario after staging mock recalls, getting the notification process down to about two hours.

Foodborne illnesses damage customer trust and wreck sales, so companies such as Chipotle and McDonald’s Corp. have invested millions of dollars to rapidly pinpoint and respond to food safety problems. They’re no longer waiting for government health agencies — swamped by outbreaks such as the recent spate of cyclosporiasis cases tied to lettuce served at Taco Bell and other stores — to issue recalls. With their reputations at stake, large chains are identifying problematic ingredients on their own and removing tainted food from their supply chains to prevent a bigger, costlier fallout.

Chipotle’s shares dropped 9.7% on Aug. 4, the most in more than nine months, after Bloomberg News reported the chain had pulled the jalapeños. The cyclospora outbreak, linked to produce supplier Taylor Farms, has hurt business even for chains whose lettuce wasn’t contaminated, such as Sweetgreen Inc.

“Food companies get one chance to get this issue right,” said Pam Goldstein, a crisis communications consultant who was working at McDonald’s Corp. when the company got hit by an E. coli outbreak linked to tainted onions in 2024. “If you fumble on a food safety crisis, you will destroy years and years of goodwill that you have built up with your customers.”

Corporations are increasingly conducting dry runs of recalls, down to drafting templates of what they’ll tell customers if there’s an issue, Goldstein said.

Chipotle, in particular, is vigilant about its food-safety credentials after suffering a series of bruising foodborne outbreaks from 2015 to 2018, stemming from faulty food-handling practices.

The consequences were severe and lasted for years. In 2016, the company lost more than $900 million in sales and net income fell by 95%. The string of issues also contributed to the 2018 exit of founder and then-Chief Executive Officer Steve Ells. Chipotle later paid a $25 million fine after a US Justice Department investigation.

The company since then has spent millions of dollars to build out systems that enable it to swiftly find the source of outbreaks and notify restaurants. The protocols were put to the test during the latest salmonella outbreak. The US Centers for Disease Control and Prevention said that Chipotle’s actions meant the agency had no ongoing concern about the safety of diners eating at those restaurants.

“They’re much more proactive now than they were in the past, based on the school of hard knocks,” said Stephen Ostroff, a former deputy commissioner of the US Food and Drug Administration’s office of foods and veterinary medicine. Qdoba Restaurant Corp. also pulled jalapeños, as did Moe’s Southwest Grill, the companies told Bloomberg.

In a statement Monday, Laurie Schalow, Chipotle’s chief corporate affairs and food safety officer, said the chain was proud of its food safety systems, which are “grounded in science, technology, rigorous training and independent oversight.”

In early July, the Minnesota health department notified Chipotle that customers had become sick after eating at its restaurants, according to a person familiar with the matter who wasn’t authorized to speak publicly. Minnesota has one of the leading foodborne investigation units among US states, Ostroff said. It has a quick turnaround for tests that allow it to identify disease clusters, as well as a group of students known as “Team Diarrhea” who help call sick people to ask what they ate.

Chipotle shared a list of customer orders and contact information, which the department used to call diners to ask if they were ill and what they had eaten, said Carlota Medus, supervisor of the foodborne diseases unit at the Minnesota health department. Chipotle also shared product recipes so the department could examine the ingredients. The clues pointed to guacamole.

“Analytically, we were able to implicate guac, and all the guac ingredients, but we were not able to single out one ingredient,” Medus said.

Within roughly a week, Chipotle learned about infections cropping up in more states. The company dove into its supply chain, finding that the affected restaurants had one common grower for jalapeños — an ingredient in its guacamole. Confident that the peppers were to blame, Chipotle ordered restaurants to remove and destroy the jalapeños the week of July 20, the person said.

The company confirmed the move on Aug. 4 in response to questions from Bloomberg. The next day, the CDC said that jalapeños from Sinaloa, Mexico, distributed by supplier Coast Citrus Distributors might be contaminated with salmonella javiana and making people sick. The agency had identified 345 salmonella cases in 27 states, many of them linked to Mexican-style chains. Chipotle said in a statement that it had identified the affected produce down to the lot using its supply chain traceability system.

“Chipotle conducted their own internal traceback and their data pointed at jalapeños, so rather than waiting for the official tracebacks, they implemented measures to stop transmission,” Minnesota’s Medus said. The company shared its observations with the state’s health department and with the FDA, she said.

One of the platforms Chipotle uses is FoodLogiQ, which acts as a digital map of the company’s supply chain. Katy Jones, the CEO of parent company Trustwell, declined to comment on specific clients. But she said that when a restaurant gets a call from a health department, it can use the platform to query which products and lots arrived at the affected stores within a given timeframe. If multiple products are suspected, a company can narrow down the list of potential culprits by looking at common batches or suppliers.

An automated system pings workers via text, phone, email and an app about contaminated product, providing instructions about what to do, including which specific batches need to be removed. Progress is tracked against a countdown clock, with most clients targeting less than two hours from notification to removing the contaminated items. Managers up the chain of command get alerts if a restaurant fails to respond or confirm it took action.

“No one wants their boss knowing that they didn’t do the recall right,” Jones said.

Restaurants can be held liable even if the contamination stems from products they buy from third parties, and not from issues with how the food was prepared, said food safety lawyer Bill Marler.

“It’s their responsibility to provide a safe product,” said Marler, who in the 1990s represented customers who got sick with E. coli after eating at Jack in the Box. In one case, the company agreed to a $16 million settlement.

Although restaurants can make a business decision to pull potentially dangerous ingredients, they still generally rely on public health authorities to flag that people fell sick after eating their food. There’s a lot at stake when health authorities decide to alert the public.

“​​​​​​For the FDA, they really need a weight-of-the-evidence approach to identify the particular ingredient that’s implicated,” said Susan Mayne, the former director of what was then called FDA’s Center for Food Safety and Applied Nutrition. “If they don’t get the correct ingredient, and they’re not able to trace where that correct ingredient went, they’re not going to be protecting all consumers.”

Companies are able to move faster than they were five to 10 years ago because they’ve stepped up their traceability efforts, reacting in part to regulatory requirements such as the Food Safety Modernization Act, said Jones, the CEO. Enacted in 2011, the law requires food manufacturers to monitor hazards and have recall procedures in place. It also gave the FDA the power to mandate recalls.

Pressure from large retailers has played a role, too, she said. After an outbreak involving romaine lettuce in 2018, Walmart Inc. required its leafy greens suppliers to be able to track its products to farms, by lot, “in seconds — not days.” The company has since issued “enhanced traceability requirements to all food suppliers,” according to its website. Kroger has taken similar steps ahead of the implementation of a rule set to require food suppliers to more quickly find and remove products with higher contamination risk.

The mandate, which was set to come into effect this year but has been delayed to 2028, is “really, really important,” Ostroff said. “You want the entire system, not just certain big guys or certain types of suppliers, to have this type of technological capacity.”

—With assistance from Jessica Nix.

©2026 Bloomberg L.P. Visit bloomberg.com. Distributed by Tribune Content Agency, LLC.