The United States has now confirmed 4,080 measles cases this year, the most since 1991. The CDC’s measles data page put the count there as of October 8, with cases reported in 47 jurisdictions and 42 new outbreaks so far in 2026. That is already well past last year’s total of 2,289.
CIDRAP reports that this was the ninth straight week of double-digit increases, and that Pennsylvania alone has more than 1,100 cases, over a quarter of the national total. We covered the numbers in our news story on the 4,000 mark.
I usually write about networks and servers here. But I keep coming back to one idea when I read about this outbreak, because it is the same idea that runs through good security: protection is strongest when it is shared, and it fails at the gaps.
Herd immunity works like a firewall
Measles is one of the most contagious diseases we know of. What keeps it from moving through a community is that most people in it cannot catch it. Public health experts put that threshold at roughly 92 to 95 percent of people immune. Above that line, an infected person rarely finds someone to pass it on to, and the chain breaks.
That is very close to how a firewall protects a network. Each machine does not have to fight off every attack alone, because the traffic never reaches most of them. But a firewall with holes in it is not a slightly weaker firewall. It is an open door in exactly the places the holes are. Anyone who has run servers for long knows the trouble rarely comes through the well-maintained parts. It comes through the one box nobody patched.
Measles finds the unpatched box. According to CIDRAP, 95 percent of this year’s cases are in people who were unvaccinated or whose vaccination status is unknown. In Pennsylvania, the figure is 99 percent. CIDRAP also notes a private school in Allegheny County with an 81 percent vaccination rate, well short of the level needed to stop spread.
This is spreading here, not arriving from abroad
Measles is often thought of as something travelers bring home. This year’s numbers do not fit that picture. CIDRAP reports that 96 percent of this year’s cases are tied to outbreaks and nearly all were caught locally, with only 18 linked to international travel.
That matters for a formal reason. The U.S. declared measles eliminated in 2000. The Pan American Health Organization, which reviews that status for the Americas, defines the loss of it as “uninterrupted circulation of the same virus genotype and lineage for 12 months or more.” PAHO says it will review the U.S. and Mexico at its regular meeting in November 2026, measuring the U.S. from an outbreak that began on January 20, 2025. Canada lost its status in November 2025. KFF has a clear explainer on what the status means and what losing it would change.
Losing the label would not change anyone’s risk overnight. Like an audit finding, it would confirm a problem we already have.
Who is getting sick
Nationally, CIDRAP reports that 17 percent of cases are children under 5 and 42 percent are under 20. About 10 percent of patients have been hospitalized. Pennsylvania is different: two-thirds of its cases are adults, and its hospitalization rate is 19 percent. Measles is not only a childhood illness.
There is one encouraging sign. Pennsylvania gave more than 56,000 MMR doses in September, more than double its usual monthly number. People are closing gaps when they learn they have them.
What we do not know
The death count is not settled. The CDC lists two measles deaths this year, while Pennsylvania has identified five measles-associated deaths on its own, two infants and three adults. CIDRAP says the CDC is working with state epidemiologists on a standard case definition but has not reported progress. And we will not know the outcome of the elimination review until PAHO meets in November.
What you can do
None of this calls for panic. It calls for the same thing I would tell anyone about their computers: know what you have, and close the gaps you find.
- Find your vaccination records. Your doctor’s office, a childhood health record, or your state’s immunization registry may have them.
- Know what counts as protection. The CDC’s guidance on measles immunity lists the accepted evidence, such as written proof of two MMR doses or being born before 1957. It also notes that some people vaccinated between 1963 and 1967 got an older vaccine and may need another dose.
- Talk to your doctor if you are not sure. If you cannot find proof, your doctor can tell you whether a blood test or a vaccine dose makes sense for you.
- Check your children’s records too. Make sure their vaccines are up to date, especially if you live in or travel to an area with an outbreak.
- Follow your local health department. They post outbreak locations and exposure sites, which tell you far more about your own risk than national totals do.
A firewall protects everyone behind it, including the machines that cannot protect themselves. Herd immunity does the same for infants too young to be vaccinated and people whose health keeps them from getting the shot. Checking your own records is a small step, but it is how the gaps get closed.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
