McDonald’s Quarter Pounder hamburgers have been linked to an E. coli outbreak that has sickened at least 49 people and killed one, according to the Centers for Disease Control and Prevention.

Illnesses have been reported in 10 states, with the most cases in Colorado and Nebraska, the federal public-health agency said Tuesday. Ten people have been hospitalized. The first reported case came in late September.

McDonald’s said a subset of illnesses may be linked to slivered onions used in the Quarter Pounder. Those onions appear to have been sourced by a single supplier that serves three distribution centers, the company said.

Local restaurants have been instructed to remove the onions and distribution of slivered onions in the affected area has been paused, McDonald’s said. The company is temporarily pulling the Quarter Pounder from restaurants in Colorado, Kansas, Utah and Wyoming.

It is also removing the Quarter Pounder from some restaurants in Idaho, Iowa, Missouri, Montana, Nebraska, Nevada, New Mexico and Oklahoma.

“At McDonald’s, you can count on us to do the right thing,” Joe Erlinger , president of McDonald’s USA, said in a video statement .

Other menu items, including cheeseburgers and Big Macs, aren’t affected and will still be available, the company said.

The outbreak is a relatively rare occurrence for McDonald’s, which has long prided itself on its robust supply chain and food-safety practices. Other chains, including Wendy’s and Chipotle Mexican Grill, have struggled in recent years with outbreaks of foodborne illnesses that overall sickened hundreds of people.

McDonald’s U.S. business started to slow down this year, with the chain reporting in July its first drop in quarterly same-store sales since the Covid-19 pandemic in 2020. The company said it would offer more value options to help bring back inflation-weary customers, and recently extended a $5 meal deal into December.

The deal and other new offerings, including a Chicken Big Mac sandwich introduced this month , have helped increase domestic sales, according to market-research firms. McDonald’s is set to report quarterly earnings next Tuesday.

The person who died in the latest E. coli outbreak was an older adult in Colorado who had underlying conditions, state and federal health authorities said Tuesday. The sick people ranged in age from 13 to 88, with a median age of 26.

The CDC said the true number of sickened people is likely higher, as many recover from E. coli without medical treatment.

McDonald’s shares dropped more than 6% in after-hours trading Tuesday after finishing the session flat.

E. coli symptoms can include stomach cramps, diarrhea and vomiting. Some people develop serious kidney problems. At least one person connected with the outbreak has developed hemolytic uremic syndrome, a condition that can cause kidney failure, the CDC said.

An estimated 266,000 people in the U.S. are sickened by Shiga toxin-producing E. coli, the type involved in this outbreak, each year, leading to about 3,700 hospitalizations and 30 deaths, according to the CDC.

Food-safety missteps can cast a long shadow over restaurant chains’ sales. Chipotle took years in winning back customers after foodborne illness outbreaks between 2015 and 2018, which led the chain to revamp its food-safety practices . The company also agreed to pay $25 million to resolve criminal charges stemming from the outbreaks.

Write to Victoria Albert at victoria.albert@wsj.com