Several people were also injured in the incident on Drottninggatan (Queen Street), one of the city’s major pedestrian streets, according to the BBC.
Swedish Prime Minister Stefan Lofven said everything pointed to an act of terrorism.
Local media reported one arrest, but police have said no-one is being held.
The lorry was hijacked earlier on Friday, its owner said.
The crash happened at the Ahlens department store just before 15:00 local time (13:00 GMT).
Swedish brewery Spendrups said its lorry had been stolen on its way to a restaurant delivery.
“Someone jumped into the driver’s cabin and drove off with the vehicle while the driver was unloading,” a brewery spokesperson told the TT news agency.
Shots were reportedly fired in another part of the city, but Swedish police told local media there was no connection between the two incidents.
Witnesses say the lorry drove into the front window of the Ahlens store.
One eyewitness told the BBC she was in the shop’s fitting room when she heard the screams. “There was blood everywhere,” she said.
The shop sits close to the city’s central station, which was evacuated.
The metro was also suspended after the attack.
Officials told nearby shoppers to stay inside buildings in the immediate vicinity while the area was secured, and the wider public were advised to keep away from the city centre.
Eyewitness Gustav Hokkanen spoke to the BBC while taking refuge in a nearby shop.
“We’re being told to stay here,” he said. “I’m about 25 metres from where the incident happened. Usually I work there… It’s a total lockdown right now. It’s madness at the moment. There are lots of police outside.”
Another shopper, Niklas Edren, was still in a locked-down building, one block away from Drottninggatan, three hours after the attack.
He said, “There seems to be a feeling now that it is over, but there are still police everywhere.”
It should be recalled that six people died and at least 50 were injured when a car mounted the pavement on London’s Westminster bridge and drove at high speed through pedestrians on March, 22.