The Listeria Recall That Started With One Cheese Plant

Key takeaways:

• A Listeria strain first sampled from a sick patient in March 2023 wasn’t traced to its source until a Brentwood, New York family fell ill in May 2026, three years later. FDA and CDC traced both back to the same plant.
• One dairy in Mechanicsville, Maryland shipped cheese under several brand names. Three separate companies downstream ended up filing their own federal recalls for contamination that never touched their own facilities.
• A clean plant doesn’t insulate you if a co-packer or bulk supplier sits upstream. Whoever’s name is on the label owns the recall, whether or not their equipment ever touched the product.

On May 13, 2026, two members of the same family in Brentwood, New York got sick after eating cheese from a local retailer. State investigators traced the illness to a batch of requesón, a soft, fresh cheese similar to ricotta, that the retailer had repacked in-house. When the lab ran the genetic sequence, it matched a Listeria strain that had already put someone in the hospital back in March 2023.

That match is what cracked a three-year cold case. Working backward from the retailer, New York’s Department of Agriculture and Markets found the distributor, then the manufacturer: Clover Hill Dairy, a small operation in southern Maryland. An unopened bucket of the plant’s requesón tested positive too. By June 3, Clover Hill had issued its first recall. And the Maryland Department of Health suspended the plant’s operating license.

The case count kept climbing after that. State labs matched the outbreak strain to six more requesón samples, then to two separate environmental swabs pulled from inside the Clover Hill facility itself, weeks apart. That’s a strain that had colonized the plant, not a single bad batch that came and went. As of the CDC’s latest count, 12 people across four states have gotten sick, 10 have been hospitalized, and one person in Maryland has died. The investigation is still open.

By June 18, Clover Hill’s recall covered everything the plant makes, not just requesón: cuajada, hard cheeses, smoked and pepper varieties, all of it.

The recall didn’t end at one facility

This is the part that should worry anyone who buys from a supplier instead of running their own plant.

Clover Hill sold cheese under its own name, but it also sold cheese in bulk, in 2- and 5-gallon buckets, to customers who repackaged it themselves. Some of that same product reached shelves relabeled as KESSO, Quesos La Ricura, Izalco, De Mi Pueblo, and Rio Lindo, none of which tell a shopper, or a retailer, anything about where the cheese actually came from.

Two other companies found this out the hard way. A New York distributor, Nelson & Isa Lacteos, recalled its own repackaged requesón after state testing linked it to the same batch. And on June 26, La Ceiba Foods Latin Market recalled its own La Colonia and Selectos Latinos-branded cheese after Clover Hill, its supplier, notified it of the contamination. La Ceiba’s own facility was never implicated. Its brand name is now attached to a federal outbreak notice anyway, because that name was the one on the label the customer saw.

The cost of a co-packer’s recall

A co-packing or private-label arrangement doesn’t remove that exposure. Your own food safety program covers your building. It has no jurisdiction over the building the product came from. If a supplier’s plant is carrying an undetected problem, that problem ships under your name, on your shelf space, to your customers, regardless of what your own quality team has ever done right.

SecureCPG, which advises consumer brands on supplier contracts, estimates the average out-of-pocket cost to a brand when a co-packer’s facility triggers a recall at roughly $380,000, covering product retrieval, retailer notification, re-manufacturing, and lost sales. The co-packer’s own insurance almost never touches that bill. It’s underwritten to cover their facility and their direct liability, not your downstream recall costs, unless your contract specifically requires it.

Start building traceability systems now

FDA’s Food Traceability Rule, the FSMA 204 requirement that high-risk foods carry lot-level tracking data from ingredient to shelf, doesn’t take full effect until July 20, 2028, after Congress pushed the original date back 30 months. Until every link in a chain is required to hand over that data on request, a trace like this one still runs the way it did here: a family gets sick, a county health department notices, a state lab sequences a genome, and someone works backward one shipment record at a time. 

Manufacturers already running AI-assisted batch genealogy, matching every outbound lot automatically to every inbound ingredient, answer that same question in minutes today. Most of the supply chain this cheese moved through was still running on paper and phone calls between distributors.

None of the three downstream companies did anything wrong here. If this happened to your own supply chain, would you find out in days, not years?