Food-delivery startup DoorDash Inc. said an unauthorized third party accessed user data in May, affecting roughly 4.9 million consumers, merchants and delivery people on its platform.

The unauthorized third party could have accessed names, contact information, addresses, and the last four digits of consumer payment cards or bank accounts though DoorDash said full payment card details or bank-account information weren’t accessed in the breach. The driver’s license numbers of roughly 100,000 delivery people may have also been...