300 Products, One Ingredient: What the Pistachio Salmonella Recall Teaches About Supplier and Lot Traceability

One shipment of pistachios from a single country of origin ended up in nearly 300 recalled products sold across Canada. The finished goods were not obviously related. They carried different brand names, sat on different shelves, and were made by different companies. What tied them together was one contaminated raw ingredient that moved quietly through a fragmented supply chain of importers, repackagers and co-manufacturers before anyone connected the dots.

For food safety and quality teams, that is the uncomfortable lesson of the 2025 to 2026 pistachio Salmonella outbreak. A hazard did not enter through your own process. It arrived in a bag of nuts, and it kept surfacing in new products for months after the illnesses had been linked to their source. This article breaks down what happened, why one ingredient became hundreds of recalls, and what the Safe Food for Canadians Regulations expect from food and beverage businesses on supplier qualification and lot traceability.

Executive summary

The pistachio outbreak is a textbook case of ingredient-driven contamination spreading through repackaging. The controls that contain this failure mode are supplier qualification, lot-level traceability and recall readiness, not end-product testing after the fact. Here are the key points.

• The Public Health Agency of Canada linked 200 laboratory-confirmed Salmonella cases, 26 hospitalizations and no deaths across six provinces to pistachios from Iran and products made with them. The investigation was closed on 21 July 2026.
• The Canadian Food Inspection Agency recall grew to nearly 300 products, spanning baked goods, chocolate, spreads and snack mixes under many unrelated brand names.
• The root cause was a single imported raw ingredient repackaged and incorporated into finished goods long after import, which is why the recall list kept expanding.
• Under the Safe Food for Canadians Regulations, most food businesses must keep traceability records one step back and one step forward, with lot codes, for two years.
• Supplier qualification and lot traceability, tested with mock recalls, are what let a company find and pull affected product quickly instead of guessing.

What happened: one imported ingredient, nearly 300 products

In short: contaminated pistachios imported from Iran were repackaged and used as an ingredient across dozens of Canadian food businesses. Public health investigators tied 200 confirmed illnesses to the ingredient, and the recall of finished products grew to nearly 300 items before it was contained.

The Public Health Agency of Canada's public health notice reported 200 laboratory-confirmed cases of Salmonella illness with 26 hospitalizations and no deaths, spread across British Columbia, Alberta, Manitoba, Ontario, Quebec and New Brunswick. People became ill from early March 2025 through mid-May 2026. Investigators identified pistachios from Iran, and products made with those pistachios, as the source. Thirteen different Salmonella serotypes were found, which is itself a signal of a broadly contaminated raw material rather than a single lot failure.

The CFIA recall began in the summer of 2025 and expanded steadily. By late December 2025 the agency had updated the national recall to nearly 300 products, and Canada's temporary import restriction on pistachios from Iran remained in effect even after the outbreak investigation was closed on 21 July 2026. The recalled items were not limited to bags of nuts. They included baked goods, chocolate, spreads and mixed snacks, because the contaminated pistachios had been used as an ingredient.

Why one ingredient became hundreds of recalls

In short: one ingredient becomes many recalls when a contaminated raw material is bought, repackaged and resold through several tiers before it reaches finished-goods manufacturers. Each tier adds new brand names and new lot codes, so a single source spreads invisibly until traceback connects the products.

Pistachios are a shelf-stable commodity. They are imported in bulk, then sold and resold, repackaged into consumer bags, and used as an ingredient in bakeries, confectioners and spread makers. A private-label co-packer might buy nuts from a distributor, package them under six or seven retailer brands, and also sell the same lot to a chocolate maker down the road. None of those finished products looks related on a store shelf. All of them can trace back to the same contaminated import.

This is what makes ingredient-driven outbreaks so persistent. Even after public health investigators identify the source, the contaminated material may already be sitting in warehouses, half-finished batches and distribution channels. Recalls keep appearing as each downstream user discovers its exposure. The controlling factor is not how clean your own plant is. It is whether you can answer one question quickly: where did this lot come from, and where did it go? It is worth contrasting the pistachio case with a domestic grower cascade such as the earlier Salmonella jalapeno event, where a single farm's product moved through the fresh supply chain. The pistachio case is different because the hazard travelled inside a processed, shelf-stable ingredient across international borders and multiple repackaging steps, which stretches the traceback further and keeps product in commerce longer.

What Canadian law requires: SFCR traceability, one step back and one step forward

In short: the Safe Food for Canadians Regulations require most food businesses to keep records that trace a food one step back to the supplier and one step forward to the customer, identify the food by a lot code or unique identifier, and keep those records for two years, accessible in Canada.

Traceability sits in Part 5 of the Safe Food for Canadians Regulations. For each food you receive, prepare or send out, you must be able to identify the common name and the name and address of the business that manufactured, prepared, produced, stored, packaged or labelled it, plus a lot code or other unique identifier. You must record who supplied the food to you and the date, and who you supplied it to and the date. According to CFIA traceability guidance, records must be kept for two years, be accessible in Canada, and be provided to the CFIA on request in a usable format.

One step back and one step forward sounds simple, but the pistachio outbreak shows where it breaks. If a repackager cannot tie the retail bags it shipped back to the specific incoming lot of nuts, it cannot tell customers which of their products are affected. If a bakery records only pistachios, various suppliers rather than the lot code on the incoming bag, its traceability chain has a hole exactly where the hazard entered.

Supplier qualification: the control that would have contained this

In short: supplier qualification is the documented process of approving and monitoring the businesses that supply your ingredients, based on the risk they carry. For an imported, shelf-stable, ready-to-eat ingredient like pistachios, that means verifying the supplier's food safety controls, requiring certificates of analysis or test results, and tiering audit depth to risk.

A robust supplier qualification programme treats an imported ready-to-eat nut very differently from a domestically grown vegetable destined for a cooking step. Pistachios are often eaten without a further kill step, so Salmonella on the incoming nut can survive all the way to the consumer. That risk profile should drive stronger controls: approved-supplier lists, specifications that state microbiological limits, certificates of analysis tied to specific lots, and periodic verification testing or supplier audits.

The pistachio outbreak is a reminder that supplier oversight is not a paperwork exercise. When a contaminated ingredient enters through an approved supplier that was never really verified, the buyer inherits the hazard and the recall. Risk-tiering your suppliers, and matching audit depth to the tier, is how you decide where to spend limited verification effort. The same principle drives accountability when a contract manufacturer or supplier fails: you cannot outsource the responsibility for the safety of what you sell.

Lot-level traceability and mock recalls

In short: lot-level traceability means you can link a specific incoming ingredient lot to every finished-product lot it went into, and then to every customer who received it. A mock recall tests that link under time pressure before a real event does.

During a real recall, speed and precision decide how much product you pull and how much reputational and financial damage you take. If your records let you isolate exactly the finished lots that used the affected pistachio lot, you recall those and only those. If they do not, you face a choice between recalling far more than necessary or missing affected product, and both are bad outcomes. As with other Salmonella controls in low-moisture foods, a mock recall run at least annually times how fast you can complete the traceback and reconcile quantities. Many inspection findings in this area come from mock recalls that take too long or cannot account for all product.

Imported ingredients need extra due diligence

In short: imported ingredients carry added risk because you have less visibility into upstream conditions and less direct recourse. Under the SFCR, importers hold specific licensing and preventive-control obligations, and they should treat foreign suppliers with at least the same rigour as domestic ones.

An importer of a shelf-stable, ready-to-eat ingredient should hold a valid SFC licence, maintain a Preventive Control Plan that addresses the specific hazards of the commodity, and keep traceability records that reach back to the foreign supplier and lot. Import documentation, certificates of analysis and any country-of-origin restrictions should be part of the incoming-goods check, not an afterthought. MFLRC's regulatory affairs, licensing and import and export support helps importers close these gaps. The temporary import restriction that Canada placed on Iranian pistachios is a reminder that country-of-origin risk is real and can change quickly.

Supplier and lot traceability compliance checklist

Use this checklist to pressure-test your programme against the failure mode the pistachio outbreak exposed.

• Maintain an approved-supplier list, with each supplier risk-tiered by commodity, origin and whether the ingredient is ready-to-eat.
• Hold written specifications for every ingredient, including microbiological limits for ready-to-eat, shelf-stable materials such as nuts, seeds and spices.
• Require lot-specific certificates of analysis or test results for high-risk imported ingredients, and file them against the incoming lot.
• Record the incoming lot code for every ingredient receipt, not just the supplier name.
• Link each incoming ingredient lot to every finished-product lot it is used in.
• Keep one-step-back and one-step-forward records, with dates, for two years and accessible in Canada.
• Address imported-ingredient hazards specifically in your Preventive Control Plan.
• Run a documented mock recall at least once a year and time the full traceback.
• Check country-of-origin restrictions and import alerts before purchasing.
• Verify that your recall procedure can isolate affected lots without over-recalling.

Common mistakes that widen a recall

• Recording only pistachios or a supplier name on receipt, with no incoming lot code, so the traceback dead-ends at the warehouse door.
• Treating an approved-supplier list as permanent, with no periodic verification, testing or audit.
• Applying the same low scrutiny to imported ready-to-eat ingredients as to low-risk domestic materials headed for a cook step.
• Relying on end-product testing to catch contamination, when Salmonella is often present at levels testing will miss.
• Keeping traceability in disconnected spreadsheets that cannot link an incoming lot to outgoing finished lots.
• Never running a mock recall, so the first real traceback happens under regulator and media pressure.

Frequently asked questions

Why did the pistachio recall keep growing after the outbreak was over?

Because the hazard was in a shelf-stable imported ingredient that had already been repackaged and used across many finished products. Even after public health investigators linked the illnesses to pistachios from Iran and closed the outbreak investigation on 21 July 2026, contaminated material remained in warehouses, batches and distribution. Each downstream user that discovered its exposure triggered another recall, which is why the finished-product list grew to nearly 300 items.

What does one step back and one step forward mean under the SFCR?

It means you must be able to trace a food back to the immediate supplier who provided it to you, and forward to the immediate customer you provided it to, with dates. You do not have to trace the entire chain yourself, but your records plus everyone else's should connect end to end. Sales made directly to consumers do not require the one-step-forward record.

How long must traceability records be kept in Canada?

Under the Safe Food for Canadians Regulations, traceability records must be kept for two years. They must be accessible in Canada and provided to the CFIA on request, in a format that can be opened and used in standard software.

Do I need lot codes on ingredients I only use internally?

You need to be able to identify each lot of food with a lot code or other unique identifier, and to link incoming ingredient lots to the finished-product lots they go into. Without an incoming lot code recorded at receipt, you cannot isolate which of your finished lots used a specific contaminated ingredient, which is the exact gap that widens a recall.

How is supplier qualification different from just having an approved supplier?

An approved supplier is a name on a list. Supplier qualification is the documented, risk-based process of verifying that the supplier actually controls the hazards in the ingredient, through specifications, certificates of analysis, testing and audits, and of monitoring that performance over time. The pistachio outbreak shows the difference: an unverified approved supplier can still deliver a contaminated, ready-to-eat ingredient.

What extra steps apply to imported ingredients?

Importers generally need a valid SFC licence and a Preventive Control Plan that addresses the commodity's specific hazards, plus traceability that reaches the foreign supplier and lot. Country-of-origin restrictions and import alerts, such as Canada's temporary restriction on Iranian pistachios, should be checked before purchase, and foreign suppliers should be held to at least the same verification standard as domestic ones.

How MFLRC can help

MFLRC helps food importers, manufacturers and private-label co-packers close exactly the gaps this outbreak exposed. Our team can run a supplier qualification and lot-traceability gap assessment and audit against your Preventive Control Plan, tier your suppliers by risk, and build specifications and certificate-of-analysis requirements for high-risk imported ingredients. We design traceability systems that link incoming lots to finished-product lots, facilitate mock recalls that test your traceback under time pressure, and prepare your team for CFIA inspection. If you import shelf-stable ready-to-eat ingredients, we can review your import documentation and country-of-origin controls so a supplier's problem does not become your recall.

Buying imported ingredients you cannot trace past your immediate supplier? A supplier qualification and traceability review now is far cheaper than a recall later.

Conclusion

The pistachio Salmonella outbreak did not spread because of a dramatic plant failure. It spread because a single contaminated ingredient moved through a supply chain that could not always trace it, one lot at a time, from import to finished product. Nearly 300 recalled items later, the lesson is clear: supplier qualification, lot-level traceability and tested recall readiness are the controls that decide whether one bad ingredient becomes one contained recall or hundreds of scattered ones. Build them before your next audit, or your next incoming shipment, finds the gap for you.

Sources and references

• Public Health Agency of Canada, Public health notice: Outbreak of Salmonella infections linked to pistachios and pistachio-containing products
• Canadian Food Inspection Agency, Pistachio recall (Salmonella) investigation
• Canadian Food Inspection Agency, Traceability requirements under the Safe Food for Canadians Regulations
• Government of Canada, Safe Food for Canadians Regulations (SOR/2018-108), Part 5 Traceability
• Government of Canada, Recalls and safety alerts