In May of 2018, PulseNet, the national molecular subtyping network for enteric pathogens, detected a multistate cluster of illnesses caused by an uncommon molecular subtype of Salmonella serovar Mbandaka. A case was defined as an illness in a person infected with the outbreak strain of Salmonella Mbandaka with illness onset on or after 3 March 2018 and before 1 September 2018. One-hundred thirty-six cases from 36 states were identified; 35 hospitalisations and no deaths were reported. Ill people ranged in age from <1 year to 95 years (median: 57 years). When standardised questionnaires did not generate a strong hypothesis, opened-ended interviews were performed. Sixty-three of 84 (75%) ultimately reported consuming or possibly consuming a specific sweetened puffed wheat cereal in the week before illness onset. Environmental sampling performed at the cereal manufacturing facility yielded the outbreak strain. The outbreak strain was also isolated from open cereal samples from ill people's homes and from a sealed retail sample. Due to these findings, the brand owner of the product issued a voluntary recall of the cereal on 14 June 2018. Additional investigation of the manufacturing facility identified persistent environmental contamination with Salmonella Mbandaka that was closely genetically related to other isolates in the outbreak. This investigation highlights the ability of Salmonella to survive in low-moisture environments, and the potential for prolonged outbreaks linked to products with long shelf lives and large distribution areas.