Attack Rate Calculator
After a wedding, a training course, or a shared meal, one number tells you how hard an outbreak hit the group that was actually exposed: the attack rate. It is the share of people at risk who became ill, expressed as a percentage. This attack rate calculator computes that percentage, the secondary attack rate among close contacts, and a full exposed versus unexposed comparison with risk ratio and risk difference, because a single percentage on its own rarely identifies the source.
The calculator below is pre-filled with a small worked outbreak: 45 people ill out of 300 at risk, for an attack rate of 15.00%. Switch tabs to see household spread (12 secondary cases among 40 susceptible contacts, 30.00%) or to compare a suspect exposure, where 40 of 100 exposed people fell ill against 10 of 100 unexposed, a risk ratio of 4.00. Every figure in the sections below is the figure the tool returns for those inputs.
Secondary attack rate measures spread within households or close-contact groups after the first cases appear.
For outbreak investigations, confirm case definitions and exposure histories before acting on a rate. A high attack rate points at a source; it does not prove one on its own.
Quick Answer
Key takeaways
- Attack rate = new cases divided by population at risk, times 100. It is a percentage for one exposed group during one outbreak, not a rate per month or year.
- The denominator decides whether the number means anything. Cases can never exceed the population at risk, and people who were not exposed or already immune do not belong in it.
- Secondary attack rate isolates household spread: secondary cases among susceptible contacts of the primary cases.
- Comparing two attack rates is where the source shows up: risk ratio above 1 with a wide risk difference is the classic fingerprint of a suspect food or exposure.
- Quick Answer
- How to use the three modes
- The formulas behind each mode
- Worked example: one event, three questions
- Food-specific attack rates: how investigators find the dish
- Attack rate, incidence, prevalence: keeping the three apart
- What competing calculators miss
- Frequently asked questions
- Add This Calculator to Your Website
- References
How to use the three modes
Start with the mode that matches your question. The first tab answers how much of one exposed group got sick. The second answers how efficiently the illness spread from first cases to their close contacts. The third answers whether a specific exposure explains the illnesses better than chance.
Attack rate tab. Enter new cases and the population at risk for a single group: one event, one classroom, one food line. You get the attack rate, the case count, and how many people stayed well (255 of 300 in the worked example).
Secondary attack rate tab. Enter secondary cases and susceptible contacts. Use this when illness appears in waves: first the people at the shared exposure, then their household members one incubation period later.
Exposed vs unexposed tab. Fill the four cells for one suspect exposure. The tool returns both attack rates, the risk ratio, the risk difference, and a one-line interpretation you can paste into a report.
One discipline applies to all three tabs: fix your case definition first. Decide which symptoms, which time window, and which laboratory confirmation count as a case before you count anything, and apply that definition identically to every group. Changing the definition halfway through an investigation is the fastest way to manufacture a misleading rate.
The formulas behind each mode
All three modes rest on one division. The CDC Principles of Epidemiology course defines the attack rate as the risk of getting the disease during a specified period, such as the duration of an outbreak, and builds the other two measures directly from it.
Two naming points cause real confusion in reports. First, the attack rate is technically an incidence proportion, not a true rate, because there is no person-time in the denominator. Second, the secondary attack rate has a denominator convention worth stating in your own write-up: this tool divides by the susceptible contacts you enter. The CDC household method often builds that denominator as everyone in the primary cases’ households minus the primary cases themselves. In its shigellosis teaching example, 17 secondary cases among 86 household members minus 18 primary cases gives 17 / 68 = 25.0%. Enter 68 as your contacts here and the tool reproduces that convention exactly. What matters is that you state which denominator you used.
Worked example: one event, three questions
The calculator is pre-filled with this case, and every number below is what it returns. A community event draws 300 people. Within the outbreak window, 45 become ill.
| Measure | Inputs | Result |
|---|---|---|
| Attack rate | 45 cases / 300 at risk | 15.00% |
| Unaffected | 300 minus 45 | 255 people |
| Secondary attack rate | 12 secondary cases / 40 contacts | 30.00% |
| Attack rate, exposed | 40 ill / 100 exposed | 40.00% |
| Attack rate, unexposed | 10 ill / 100 unexposed | 10.00% |
| Risk ratio | 40.00% / 10.00% | 4.00 |
| Risk difference | 40.00% minus 10.00% | +30.0 percentage points |
Read together, the three answers tell a coherent story. The overall attack rate of 15.00% says the event made a noticeable minority ill. The secondary rate of 30.00%, double the overall rate, says contacts of cases were at higher risk than the average attendee, which fits person-to-person spread after the event. The comparison then names a suspect: whatever exposure separates the 100-person exposed group from the 100-person unexposed group is associated with four times the illness risk. For judging whether a gap that size could be noise in a small group, a statistical significance calculator is the natural next check before you publish the finding.
Food-specific attack rates: how investigators find the dish
A food-specific attack rate is the workhorse of foodborne investigations. You compute one attack rate for people who ate each menu item and one for people who skipped it, then rank the items. The culprit pattern is consistent: a high rate among eaters, a low rate among non-eaters, and most cases accounted for by that one item.
The CDC outbreak investigation lesson works a banquet where beef produced a 65% attack rate among eaters against 11% among non-eaters, a risk ratio of 5.7, while every other dish sat near 1.0 to 1.5. That is the shape you are looking for in your own table. Run each food through the comparison tab here: eaters are your exposed group, non-eaters your unexposed group. A food everyone ate cannot be tested this way, because there is no unexposed group left to compare with, and a food almost nobody ate gives unstable rates from tiny denominators. Health departments running the population version of this work, planning how many people a program must cover, often pair it with a capitation rate calculator when the question shifts from outbreak source to service coverage.
Attack rate, incidence, prevalence: keeping the three apart
These three measures share a numerator habit and get swapped constantly. Attack rate covers a defined exposed group during an outbreak and is a percentage. Incidence rate counts new cases per person-time in a general population, so two outbreaks with the same attack rate can have very different incidence if one unfolded over a weekend and the other over a season. Prevalence is a snapshot of existing cases at one moment, old and new together, and it answers a different question entirely: burden right now, not risk from an exposure.
The practical test is the denominator. People at risk from one exposure: attack rate. Person-time across a population: incidence rate. Everyone alive with the condition today: prevalence. Workplace safety teams use a cousin of the same thinking when they track injuries per hours worked with an accident frequency rate calculator, and school or program administrators use participation denominators the same way in an enrollment rate calculator. The arithmetic is easy; choosing the right denominator is the skill.
What competing calculators miss
The top-ranking attack rate tools are single-division boxes: cases in, population in, percentage out. Calculator Friend, Calculator Ultra, and Brave Calculator all stop there. None of them computes a secondary attack rate, none builds the 2 by 2 table, and none returns a risk ratio or risk difference, which are the outputs an investigator actually files. One widely read guide even presents the formula with multipliers of 1,000 or 100,000 as interchangeable options, which produces numbers no outbreak report would use: the outbreak attack rate is conventionally a percent.
Two gaps matter most. First, validation: a single-box tool will happily report an attack rate above 100% when the denominator was entered wrong. This tool refuses cases greater than the population at risk and tells you to check the denominator, which is where the error almost always lives. Second, interpretation: a bare percentage cannot distinguish a shared-source outbreak from household spread. Pairing the overall rate with the secondary rate and the exposed versus unexposed comparison, in one place, is what turns a percentage into a working hypothesis about the source.
Frequently asked questions
The attack rate is the percentage of an exposed, at-risk group that becomes ill during an outbreak. The Centers for Disease Control and Prevention treats it as a synonym for risk in outbreak settings: new cases divided by the population at risk, multiplied by 100. In the worked example, 45 cases among 300 people at risk gives an attack rate of 15.00%.
Divide new cases by the population at risk and multiply by 100. Only count people who were exposed and could have become ill in the denominator, and only new cases that began during the outbreak period in the numerator. The calculator rejects cases greater than the population at risk, because that result always signals a denominator error.
The secondary attack rate is the attack rate among susceptible contacts of the first, or primary, cases. It measures person-to-person spread inside households, dormitories, barracks, or other closed groups. Here, 12 secondary cases among 40 susceptible contacts gives 30.00%. A high secondary rate points to efficient household transmission rather than a single shared source.
Attack rate is a proportion for a defined exposed group over the short duration of an outbreak, and it carries no time unit. An incidence rate counts new cases per person-time in a wider population, so it does carry a time unit. The CDC notes the attack rate is more precisely an incidence proportion, which is why it is always between 0% and 100%.
It means the exposed group became ill at four times the rate of the unexposed group. In the comparison example, the attack rate was 40.00% among exposed people and 10.00% among unexposed people, so 40 divided by 10 gives a risk ratio of 4.00. A risk ratio of 1.00 means identical rates and no link to the exposure in that data.
It is an attack rate computed separately for each food or exposure: cases among people who ate the item divided by everyone who ate it, compared with the same rate among people who did not eat it. Investigators rank foods by the gap between the two rates. The suspect food usually shows a high rate among eaters, a low rate among non-eaters, and a risk ratio well above 1.
No. Cases are a subset of the population at risk, so the rate tops out at 100%. A result above 100% means the denominator is wrong: common causes are counting only people who sought care, including immune people inconsistently, or mixing two different groups in the numerator and denominator.
Because small denominator errors move the rate a lot. If 45 cases came from 300 exposed people the rate is 15.00%, but if only 200 of those 300 were truly susceptible, the correct rate is 22.50%. Deciding who was genuinely at risk, including how to handle people already immune, is the judgment call behind every published attack rate.
No. A high rate is strong evidence pointing at a source, especially with a high risk ratio, but investigators still check timing, incubation periods, laboratory results, and whether another shared exposure explains the same cases. Attack rates narrow the search; they do not close it.
Add This Calculator to Your Website
References
- Centers for Disease Control and Prevention, “Principles of Epidemiology in Public Health Practice, Lesson 3, Section 2: Frequency Measures” – defines the attack rate, food-specific attack rate, and secondary attack rate, with the shigellosis household example. CDC: Lesson 3, Section 2, Frequency Measures. Accessed October 2026.
- Centers for Disease Control and Prevention, “Principles of Epidemiology, Lesson 3, Section 5: Measures of Association” – works the 2 by 2 table, attack rates by group, and risk ratio step by step. CDC: Lesson 3, Section 5, Measures of Association. Accessed October 2026.
- Centers for Disease Control and Prevention, “Principles of Epidemiology, Lesson 6, Section 2: Steps of an Outbreak Investigation” – applies food-specific attack rates and risk ratios to a real banquet outbreak table. CDC: Lesson 6, Section 2, Outbreak Investigation. Accessed October 2026.
- Centers for Disease Control and Prevention, “Principles of Epidemiology, Lesson 3, Section 1: Frequency and Pattern” – explains why the attack rate is an incidence proportion rather than a true rate. CDC: Lesson 3, Section 1, Frequency and Pattern. Accessed October 2026.
- Centers for Disease Control and Prevention, “Principles of Epidemiology in Public Health Practice, Self-Study Course SS1978” – the full course home for the lessons cited here. CDC: Principles of Epidemiology Course SS1978. Accessed October 2026.
- Dicker RC and co-authors, “Epidemic Investigation” in PMC (PubMed Central) – reviews relative risk from attack rates using the classic Oswego church dinner salmonellosis outbreak. PMC: Epidemic Investigation. Accessed October 2026.
- Centers for Disease Control and Prevention, Foodborne Diseases Active Surveillance Network (FoodNet) report, MMWR 2023 – shows how outbreak and incidence data are reported at national scale. CDC MMWR: FoodNet Incidence and Trends, 2022. Accessed October 2026.
- Food and Agriculture Organization of the United Nations, “Epidemiological information” (Manual on the Preparation of Food Safety Emergency Response Plans) – documents attack rate ranges and exposed-population estimation in a cheese-associated outbreak. FAO: Epidemiological Information and Attack Rates. Accessed October 2026.
- OpenStax, Population Health for Nurses, “Key Terms: Epidemiology for Informing Population and Community Health Decisions” – glossary definition of attack rate as the proportion of a population that develops illness during an outbreak. OpenStax via LibreTexts: Epidemiology Key Terms. Accessed October 2026.
- COVID-19 Student Response Curriculum, “Introduction to Epidemiological Terms” – teaching definitions of attack rate, R0, and effective reproduction number used in outbreak courses. COVID-19 Curriculum: Introduction to Epidemiological Terms. Accessed October 2026.