This photo taken through a microscope provided by the CDC shows Cyclospora cayetanensis oocysts found in a fresh stool sample which had been prepared with a formalin solution and stained with safranin. (CDC via AP, File)
Associated Press
Back in 2014, three data scientists from Mastercard, Jeremy Pastore, Michael Zhao, and Arun Elangovan, submitted a patent application for a method to detect disease outbreaks using payment data. Their idea involved real-time analysis of payment-card transactions to identify the spread of an outbreak. Although the patent was approved in 2019, it was never put into practice.
This summer, the potential value of such a tool became evident. The United States is experiencing its most severe cyclosporiasis outbreak on record. Cyclosporiasis, an intestinal illness caused by the parasite Cyclospora cayetanensis, is contracted through consuming fresh produce contaminated by water containing human waste. The infection results in prolonged watery diarrhea, typically starting a week after consumption. The parasite requires one to two weeks in the environment to become infectious, thus it doesn’t spread directly from person to person.
The main cluster of cases was investigated using traditional methods, interviewing affected individuals to find a common link. Michigan’s health department reviewed the dietary histories of 190 individuals who had contracted the parasite after eating at Taco Bell, with 90 percent reporting having consumed iceberg lettuce. The FDA linked the lettuce to a grower in central Mexico, prompting Taylor Farms de Mexico to withdraw it from the U.S. market on July 17.
However, the conclusion is more robust epidemiologically than it is scientifically, as no laboratory evidence supports it. A lettuce sample initially tested positive on July 18, only for the FDA to retract this result as a false positive the following day. While no product sample has tested positive, the FDA maintains the recall, grounding it on interviews and traceback investigations. This cluster is just part of the larger outbreak, which spans 34 states, with most cases lacking an identifiable source.
The delay in identifying the restaurant was significant. The first cases emerged on May 13, and a cluster appeared on the FDA’s watch list by mid-June without a known source. Taco Bell removed fresh produce from affected state locations on July 9. The lettuce and the grower were identified a week and a day later, respectively. While identifying the vendor took two months, subsequent steps took only days.
The main obstacle was not the lettuce, but identifying Taco Bell as the source. “Once you know it’s Taco Bell,” said Pastore, “triangulating the rest is probably fairly straightforward. And the hard part is the Taco Bell.” The challenge lies in relying on people’s recollection of where they ate weeks prior, which is the weakest link in the investigative process.
A Taco Bell fast food restaurant is shown Tuesday, July 14, 2026, in Taylor, Mich. (AP Photo/Paul Sancya)
Copyright 2026 The Associated Press. All rights reserved
Everything We Eat Is Bought
Memory isn’t the sole method to track eating habits. The American diet largely involves transactions, each leaving a digital footprint. Groceries, restaurant meals, and delivery orders are recorded with timestamps, stored on servers owned by various entities. These records have already been used to track outbreaks.
Indeed, they can be effective. A Salmonella outbreak in 2009 and 2010 was unraveled using warehouse-club membership records, identifying 19 patients who all purchased the same salami. A 2018 review indicated that purchase data pinpointed the source in 19 out of 20 outbreaks where investigators tested it. A 2022 simulation among nearly a million Norwegian shoppers identified the contaminated item with 90% accuracy after just six cases.
These cases reveal a pattern: investigators already knew which store to target. A loyalty program provides insight into a single merchant, but only once that merchant is under suspicion. The warehouse-club records cracked the salami case because investigators already had suspicions. Michigan identified Taco Bell by conducting interviews with 190 affected individuals over eight weeks. Purchase data confirmed a hypothesis generated by conventional epidemiology, serving a different purpose than identifying the vendor.
The Norwegian study quantifies this gap. Restricting the model to one grocery chain when the contaminated product was sold in two reduces accuracy from 92% to 67%. Outbreaks don’t adhere to a retailer’s customer base, nor does a person’s diet. A record that tracks spending across all locations is necessary to address this.
This record exists—held by a payment network—precisely what Pastore, Zhao, and Elangovan proposed in 2014.
Built for a Different Job
The idea was eventually shelved for reasons that now seem irrelevant. Pastore, now leading a team in Mastercard’s economic intelligence group, explained that it was an exploratory project that was never fully pursued. The absence of SKU-level data, detailing what was purchased rather than where, halted its progress. His team found no usable link between influenza trends and spikes in drugstore spending after a month of analysis.
The product was elusive, but the data on spending locations was precise, which took Michigan two months to establish. When asked if they had considered identifying the merchant, Pastore said they hadn’t.
A substantial framework exists. Pastore’s team conducted a search for prior art, developed a prototype, sought executive feedback, and obtained a patent detailing the method. Mastercard’s infrastructure already supports real-time consumer spending analysis for various stakeholders. This system is operational daily.
Item-level data is available from brokers, though privacy commitments limit what a payment network can share. The government, the natural customer, is slow to adopt such capabilities, especially for “rainy day” scenarios—capabilities anticipated for crises that haven’t yet occurred. There’s no accountability for lacking them until they are needed.
Consent offers a potential solution without requiring a surveillance system. Patients interviewed by health departments could authorize investigators to access transaction records or provide card statements. Pastore agreed this could be viable. Addressing privacy on a case-by-case basis could be effective, given that Michigan dealt with only 190 cases.
Public health is exploring new data sources to detect outbreaks earlier. These streams capture reports of illness on social media and consumer complaint sites, but purchasing data remains unseen.
A Detector Without an Owner
When I contacted Pastore, he hadn’t thought about the patent in years, even during the ongoing outbreak. Asked who should develop such a system now, he suggested the government could take on the task, similar to its economic survey functions.
Pastore’s suggestion is valid, and the case for it is stronger than he implies. The challenge that halted Mastercard doesn’t affect the issue that delayed this summer’s investigation. Identifying a merchant doesn’t require SKU-level data.
Although surveillance isn’t my primary field, I’m unaware of any operational system implementing this approach. However, it should be part of the public health toolkit, alongside mandatory disease reporting and pathogen sequencing, providing value during crises.
The concept lacks an owner. Monitoring economic data for outbreak indicators falls under public health but isn’t the responsibility of a payment company. This leaves two possibilities: a federal office treating surveillance as infrastructure, or one of the emerging firms specializing in infectious disease intelligence. This capability aligns with their objectives.
A system as envisioned by Pastore and his colleagues wouldn’t suffice alone. Knowing that affected individuals dined at Taco Bell or purchased identical salami is a lead, not a solution. Buying lettuce doesn’t prove consumption. The data only applies to card and app users, and the main challenges are consent, privacy law, and accessing company-held records. A purchase record expedites investigations but doesn’t conclude them. No laboratory confirmed the lettuce, and the recall is based on expert reasoning distinguishing correlation from causation. However, an outbreak taking two months to trace underscores the need to utilize every available objective record, including one that remains patented and unused.
