• McDonald's stock has fallen 5% since the CDC released an advisory notice saying that its Quarter Pounder burgers have been linked to an E. coli outbreak in 10 states.
• The investigation to find the source of the outbreak could take as long as several more months, although investigators have honed in on the onions used in the burger as a likely source.
• McDonald's has also already taken steps to reassure customers that its food is safe to eat, including pulling Quarter Pounder burgers from roughly a fifth of its U.S. locations.

As McDonald's and health authorities race to contain a deadly E. coli outbreak, the burger chain faces challenges in the months ahead to keep the trust of diners and investors.

Shares of the fast-food giant have fallen 5% since the Centers for Disease Control and Prevention issued an advisory notice Tuesday, warning that the company's Quarter Pounder burgers have been linked to an E. coli outbreak in 10 states that has led to one death.

Health investigators have zeroed in on the slivered onions used in the Quarter Pounder as the likely contaminant. McDonald's confirmed that California-based vegetable producer Taylor Farms is the supplier of onions it removed from its supply chain. Taylor Farms issued a recall on four raw onion products, citing potential E. coli contamination, restaurant supplier U.S. Foods said in a notice to customers Thursday. (U.S. Foods is not a supplier for McDonald's.)

The CDC reported 49 people became ill from the outbreak from Sept. 27 to Oct. 11, as of Tuesday. Health experts say the number of cases will likely rise as the investigation progresses.

Just two days after the CDC issued its advisory notice, it's too soon to tell how the outbreak could affect McDonald's business, especially if the case count grows. But investors are already worried that it could cause sales to fall at the company, which has been trying to rebound from lagging traffic by offering deals to price-sensitive customers.

Company spokespeople said Wednesday that's it's far too early to share if the outbreak was having any effect on its restaurants' sales. McDonald's is expected to report its third-quarter results on Oct. 29 before the markets open.

The damage to the business will depend in part on how effectively McDonald's has already contained the outbreak — and how well it can convince diners it is safe to eat at its restaurants.

Where the investigation could go next

Investigations into multistate foodborne outbreaks can last from a few weeks to up to several months. 

But Dr. Thomas Jaenisch, an epidemiology professor at the Colorado School of Public Health, believes it will likely take two or three weeks for federal agencies and McDonald's to determine the exact source of contamination and chain of events leading to the E. coli outbreak. He said any testing of ingredients and supply sources "really shouldn't take that long."

The CDC has said the number of confirmed cases related to the McDonald's E. coli outbreak could grow as the investigation continues, as many people recover from an infection without testing for it or receiving medical care. It also typically takes three to four weeks to determine if a sick patient is part of an outbreak, the agency added. 

There's also the possibility that cases could crop up in new states or regions that haven't reported any illnesses, according to Xiang Yang, a professor and meat scientist at the University of California, Davis. 

For example, a person traveling to a state impacted by the outbreak, such as Colorado, could have gotten infected with E. coli and brought it back to where they are from, according to Yang. It is also unclear if the onion supplier ships ingredients to restaurants in other regions of the U.S., which could potentially spread the E.coli strain that caused the McDonald's outbreak. 

That strain, called O157:H7, can cause a serious complication that can lead to kidney failure. One of the patients in the McDonald's outbreak suffered from that condition, known as hemolytic uremic syndrome. The federal government essentially bans the sale of any ground beef contaminated with the strain, requiring suppliers to test their products for it.

E. coli can spread through contaminated food or water, or by an individual coming into contact with an infected person, environment or animal. 

The CDC and the 10 states impacted have been interviewing each patient case to get detailed information about their exposure to E. coli, such as what they ate and when, according to Craig Hedberg, the co-director of the Minnesota Integrated Food Safety Center of Excellence. Hedberg is also a member of the McDonald's Food Safety Advisory Council, but said he has not worked with the company on its response to the outbreak. 

The CDC and the states have been sharing the information they gather with the Food and Drug Administration to trace onion distribution and identify a specific source of contamination, he said. The information is also shared with the U.S. Department of Agriculture's Food Safety and Inspection Service, which does the same with ground beef. 

The CDC is investigating both the Quarter Pounder's uncooked slivered onions and its beef patty as the potential culprit for the outbreak. 

Hedberg said contamination of raw onions with E. coli is "highly plausible," noting several salmonella outbreaks have been linked to onions in recent years. 

McDonald's uses a single onion supplier, which washes and slices the vegetable, in the affected area. 

Meanwhile, McDonald's uses multiple beef suppliers in the region, and its burgers are supposed to be cooked to an internal temperature that would kill the bacteria. The size of the outbreak "would imply widespread undercooking by many different individual McDonald's restaurants" if beef was the culprit, according to Hedberg.

But he said that seems unlikely since most fast-food chains have designed their cooking systems to prevent E. coli contamination of ground beef, which is a widely recognized hazard. Still, investigators will likely examine the cooking practices of multiple locations as part of the investigation, Hedberg noted. 

Jaenisch said he hopes the investigation will also examine the preparation process for Quarter Pounders to see if there is any potential for cross contamination between slivered onions and other ingredients.

"When you prepare the burger at McDonald's, at which point are the slivered onions added? Do they have a bowl of slivered onions, someone puts their hands in it and then touches the tomatoes?" Jaenisch said. "I would look very closely at that point of preparation."

McDonald's has already pulled Quarter Pounders from restaurants in the affected areas. Roughly a fifth of McDonald's U.S. restaurants are not selling Quarter Pounder burgers at this time. The company has also instructed restaurants in the area to remove slivered onions from their supply, and has paused the distribution of that ingredient in the region.

Learning from the past

Based on past foodborne illness outbreaks at other restaurant chains, it's not a given that McDonald's sales and brand image will suffer.

For example, rival Wendy's dealt with its own link to an E. coli outbreak two years ago. More than 100 people got sick across six states. Still, the incident didn't have a long-term effect on the chain's sales.

"They got past it, and you never really heard about it," KeyBanc analyst Eric Gonzalez told CNBC. "I think there were some operators in the area that probably saw a mid-to-high single digit, maybe 10% decline for a couple days of a week or so, and then it reverted as the news cycle moved on."

On the other side of the spectrum is Jack in the Box, which became the poster child for food safety issues decades ago.

An outbreak in 1992 and 1993 linked to the chain resulted in the deaths of four children and infected more than 700 people. Media coverage, coupled with the severity of the outbreak, led to a steep decline in sales that year, fueled three straight years of losses and tarnished Jack in the Box's reputation for years.

And then there's Chipotle, a more recent example of a chain that struggled for years to improve its food safety and turn around its image after a string of foodborne illnesses.

"It was sort of a victim of its own inexperience, in a way, where not only were there multiple illnesses — E. coli, salmonella, norovirus — but you didn't really have the expertise and experience level to manage through the crisis," Gonzalez said.

After the initial wave of outbreaks in 2015, it took Chipotle several more years and a new CEO to rebuild trust in its burritos and bowls.

While investors fear the outbreak will hit McDonald's sales, it's unlikely that the burger giant turns into another Chipotle or Jack in the Box.

"We don't know where this is going to land, as far as McDonald's is concerned, but you have to have a little bit of confidence in their ability to contain the outbreak," Gonzalez said. "It's a very sophisticated organization with a sophisticated supply chain, and I don't doubt their capabilities."

Reassuring customers

McDonald's has already been taking steps to reassure customers about the safety of its food. Barring a much more serious crisis, it may be able to contain the damage to its brand, experts said.

Shortly after the CDC issued its notice, the company released a statement outlining the steps it's taken to contain the outbreak, along with a video featuring McDonald's USA President Joe Erlinger.

The following morning, Erlinger appeared on NBC's "TODAY," telling viewers — and potential customers — that its food and drinks were safe to consume.

"Any kind of product safety recall requires some crisis communication and reassurance on the part of the corporation that it takes safety seriously, that it takes consumer health seriously and that it will react appropriately," said Jo-Ellen Pozner, associate professor at the Santa Clara University Leavey School of Business.

She added that she thinks McDonald's needs to apologize "very publicly" and aim its messaging at both consumers and its shareholders. However, that transparency means more media coverage, which reminds consumers about the crisis and risks scaring them away from McDonald's restaurants.

Yang said McDonald's appears to be "doing what they can do so far" while waiting for more information on the specific source of contamination. 

But other experts hope the chain does more to mitigate the potential spread of the outbreak during the investigation.

Dr. Darin Detwiler, professor of food policy and corporate social responsibility at Northeastern University, said he believes locations in other unaffected states should be "doubling up on their sanitation procedures and protocols and do more testing of their ingredients." 

"Don't wait until the lawyers or inspectors say you have a problem," Detwiler said. 

"Why don't you make the assumption that there could be something in your state, and check out your product," he said. "That is being proactive. That is corporate social responsibility."

Bill Marler, an attorney who specializes in cases involving foodborne illnesses, said McDonald's should also follow in the footsteps of Jack in the Box, which offered to pay medical bills and lost wages for the victims of its E. coli outbreak.

"They just need to be seen as a good corporate player, and that's really how they're going to be able to bounce back pretty quickly," Marler said.

One potential plaintiff tied to the crisis has already reached out to Marler, who represented hundreds of people who sued Jack in the Box in a class-action lawsuit, leading to a settlement of more than $50 million.

McDonald's is already facing at least two lawsuits tied to the outbreak.

Both Clarissa DeBock, of Nebraska, and Eric Stelly, a resident of Greeley, Colorado, are suing the company for damages in excess of $50,000 after allegedly testing positive for E. coli after eating at McDonald's, according to court filings.

"McDonald's has nowhere to hide. They're strictly liable for producing food that was contaminated. They may be able to point the finger at the onion supplier or the meat supplier, but ultimately they made the hamburger," said Marler.

McDonald's declined to comment on the lawsuits.

While media coverage of related lawsuits could bring more attention to McDonald's, the suits themselves are unlikely to threaten the chain's existence, according to Pozner.

"McDonald's is as ubiquitous as Coke. It's one of these very taken-for-granted brands, for its value as a brand to be diminished in a significant way, would require a much more serious outcome of the E. coli outbreak," she said. "The scope of this tragedy is still very contained."

Slumping sales

The outbreak comes as McDonald's tries to win back diners who balked at years of price increases. For months, McDonald's has been locked in a war with its rivals over competing value meals.

The restaurant industry broadly has seen traffic fall as inflation-weary consumers cook more at home and visit eateries less frequently. Fast-food chains, including McDonald's, Burger King and Wendy's, have turned to discounts and value meals to win back customers.

McDonald's U.S. restaurants have been offering a $5 value meal since late June. And earlier this month, the chain launched its Chicken Big Mac nationwide, betting that customers would be willing to pay its higher price point because of the novelty. Those moves seemed to be paying off for McDonald's before the outbreak.

"This is somewhat of a momentum killer for them," Gonzalez said, adding that the burger category has plenty of "capable substitutes" for McDonald's.

Combined, McDonald's, Burger King and Wendy's control roughly 70% of the burger quick-service restaurant segment, according to Barclays. McDonald's alone holds 48.8% market share.

"It's not a zero-sum game, but the burger category specifically is one of the more concentrated segments," Gonzalez said. "If McDonald's loses a point of sales, that's 3 to 4 points up for grabs for Wendy's or Burger King to capture."