Stratosphere · 01
The repricing of trust
On cereulide, the Hipp recall, and what private testing actually buys.
The first event arrived quietly, the way structural events usually do. On 10 December 2025, Nestlé France pulled batches of infant formula produced at its Nunspeet plant in the Netherlands, citing a quality issue in an ingredient.1 Within six weeks the recall had spread to sixty countries and to most of the global infant-formula majors — Danone, Lactalis, Hochdorf, Vitagermine. By 25 February the World Health Organization was tracking contaminated batches distributed across ninety-nine countries and 144 suspected or confirmed cases of cereulide intoxication in infants across ten countries in three WHO regions.2 The toxin had entered the formula through arachidonic-acid oil sourced from a single Chinese fermenter — an ingredient added to support infant brain and eye development, supplied by a producer most of the recalling brands had in common. The choice of supplier, Nestlé’s CEO would say in February, had not been a question of cost. It had been a question of supply security: for years, only one fermenter at scale had reliably produced the ingredient.3 Resilience, in this case, had concentrated rather than diversified the risk.
The second event arrived four months later, on the bottom of a glass jar. In mid-April 2026, an Austrian customer at a SPAR store in Burgenland noticed a small white sticker with a red circle on the underside of a HiPP Babykostgläschen. Police laboratories confirmed the contents had been adulterated. Further marked jars surfaced in Czechia and Slovakia. The Austrian Federal Police opened an extortion investigation. SPAR pulled the entire HiPP infant-food range from its Austrian shelves and extended the precaution to other SPAR markets.4 HiPP itself was not at fault — the jars had left the factory clean. But the entire commercial relationship between brand, retailer, and consumer turned, for several days, on the question of which jars on which shelves on which dates could be cleared.
The two events have nothing in common at the surface. One is a public-health failure originating four thousand kilometres upstream in a microbial-fermentation tank. The other is a criminal manipulation by an extortionist in a Burgenland aisle. Read together, they are the same event told twice: a category whose entire commercial value depends on parental trust just got told, twice in five months, that the layer responsible for proving safety is thinner than anyone wanted to believe.
What the cereulide event was actually about.
The cereulide recalls have been described, accurately, as a contamination crisis. They are also, less obviously, a sourcing-architecture crisis. ARA oil — produced by fermenting Mortierella alpina, the fungal species used to deliver omega-6 fatty acids critical to infant development — has historically been a single-source ingredient. Manufacturers diversified slowly, partly because qualifying a new fermenter for infant nutrition is a multi-year process, partly because the ingredient is small relative to the formulation and the market underrewarded redundancy. When a single Chinese supplier’s process produced cereulide-bearing batches, every premium infant formula on the European shelf was exposed to the same upstream point of failure simultaneously.
The European response has been swift in the way that crises clarify what was always possible. The European Food Safety Authority, between January and February, established an acute reference dose for cereulide in infants — a regulatory threshold that did not exist before December 2025.5 The European Commission imposed enhanced import controls on Chinese ARA oil.6 A Swiss refiner, Nutriswiss AG, has nearly completed a process to remove cereulide from contaminated batches at scale, reducing toxin loads by roughly 99.99%.7 Manufacturers who had relied on the one supplier are quietly rebuilding the second-source relationships they had not previously needed.
None of this, however, addresses the underlying problem. The cereulide event was not detected by the manufacturers. It was detected at the consumer end, downstream of every quality system in the supply chain, in stool samples and emergency-room intake notes. The defensive layer that most premium infant brands had counted on — supplier audits, batch testing, certificates of analysis — was not actually testing for the toxin that mattered, because the toxin was not on anyone’s list. It became visible only because a Belgian child was sick enough for a hospital to look closely. The supply chain learned about its own contamination from the people it was supposed to be protecting.
"The supply chain learned about its own contamination from the people it was supposed to be protecting."
What the HiPP event was actually about.
The Burgenland tampering case sits at the opposite pole of the supply chain — not upstream production but downstream physical custody — and reveals a symmetric weakness. HiPP’s manufacturing process worked exactly as designed. The batches that left the factory were not adulterated. The compromise occurred between the loading dock and the consumer’s hand, in the section of the chain where, after distribution to a retailer, no manufacturer can credibly claim to know what has happened to a specific jar.
The retailers most exposed to this kind of event are not the obvious ones. In the German market, twenty cents of every euro spent in drogerie chains — dm, Rossmann, Müller — now goes to food, up from sixteen cents five years ago, and roughly half of that food revenue is now organic.8 Drogerie chains grew their Bio-food turnover by twenty-one percent year-on-year in early 2025; supermarkets grew by under seven.9 Baby and infant products were one of the original frequency drivers behind that shift. The category that now sits most prominently on drogerie shelves — premium, organic, parent-trusted, often own-brand — is also the category whose data layer was built for a less consequential moment.
What followed the Burgenland sticker exposed the limit of recall scoping. A targeted withdrawal — pull only the jars from this batch sold to this retailer between these dates — would have required real-time linkage between manufacturer-side batch data and retailer-side point-of-sale data. That linkage does not exist in most current commercial relationships in DACH grocery. The fallback, used by SPAR, was the maximum-precaution withdrawal: every HiPP jar in every Austrian store, regardless of batch. This is the rational decision in the absence of better information, but it costs the manufacturer a category presence and the retailer a category margin, and it informs the consumer that the system is operating in a binary mode of everything is safe or nothing is.
The criminal in the Burgenland case did not have to break the supply chain. They only had to demonstrate that the supply chain had no fine-grained way to respond. Once the marked jars were confirmed in Czechia and Slovakia, the response had to escalate to multi-country, all-batch withdrawal — not because the threat had grown, but because the system could not selectively prove which jars were unaffected.
The shared layer.
Both events expose the same architectural fact. The data layer that connects a raw material to a finished batch to a specific shelf to a specific consumer is, in most of European baby food, discontinuous. Different parts of the chain hold different parts of the picture. The fermenter knows the lot it shipped. The brand knows the formulation it produced. The retailer knows the store it stocked. The household knows the jar it opened. None of these systems were built to talk to each other in real time, and most of them are not contractually permitted to.
This was acceptable, perhaps, when the trust premium in baby food was both stable and sufficient. The premium was stable because incidents were rare; it was sufficient because parents accepted the brand promise as a substitute for visibility into the chain. The cereulide and HiPP events have together moved that premium. They have not collapsed it — parents will continue to buy premium baby food, and most do so today — but they have made it conditional in a way it was not before. Conditional on what can be proven, not on what can be claimed.
Three behavioural shifts are already visible to anyone who watches the operational layer of the DACH organic and baby-food sector. First, larger producers are accelerating the second-sourcing of critical fermentation ingredients, partly because EU regulators have signalled they will require it, partly because the market will reward those who can demonstrate it. Second, retailers carrying private-label baby and sensitive-category lines — most prominently dm with babylove and dmBio, but the same applies to Müller, Rossmann, and the Bio-supermarket chains — are quietly examining what they would be able to prove if a similar event hit their own brands. The honest answer, in most cases, is less than the brand commitments imply. Third, the certification bodies that already operate the data backbone of European organic supply — Bio Austria, Demeter, the national control bodies in the Nordic and CEE states — are being asked, for the first time in a long time, what their datasets could do if they were joined.
What gets built next.
The conventional response to a trust event is brand reassurance. Press releases, full-page newspaper notices, parent service hotlines, public statements about commitment to safety. All of this has already happened, and it is necessary, and it is also no longer sufficient. The brands that emerge stronger from the next eighteen months will be those that can demonstrate, not assert, the trustworthiness of their supply chain — and demonstration requires a data layer that today exists in fragments.
The fragments are not far apart. They sit in the operational systems of European organic certification — bodies that already know which producer is certified by whom, with what inputs, sourced from where, and with what audit history. They sit in the ERP systems of the producers themselves, where lot genealogy and recipe traceability can already, in principle, follow an ingredient from supplier through to finished batch. They sit in the lab systems of accredited testing institutes, where individual results exist but are rarely joined to the manufacturing context that would make them readable as a longitudinal signal. And they sit, increasingly, in the retailer-side data that records which batch arrived at which store on which day.
What is missing is not technology. It is the connective layer — the agreement, governance, and architecture that lets these fragments be joined when they need to be, without violating the commercial relationships that today keep them separate. The work of the next two years in DACH sensitive-category food is not the construction of new traceability systems. It is the deliberate joining of the systems that already exist.
At 44up, we observe the operational layer of European organic supply — the certification bodies, the producers, the cooperatives, the Lieferdienste, the mills — at close range. From that vantage, the cereulide and HiPP events are not anomalies. They are early signals of a category in which the data layer is becoming the differentiator. The brands and retailers that recognize this will not be the ones with the loudest claims. They will be the ones who, the next time a question is asked, can answer it with their existing data, joined.