“There are deaths, and many injured,” Nina Odermalm Schei, a spokeswoman for Swedish intelligence agency Sapo, told AFP, without giving a precise figure.
“Sweden has been attacked. Everything points to a terror attack,” said Prime Minister Stefan Lofven.
Pictures showed a large blue truck with a mangled undercarriage smashed into the Ahlens department store.
The incident occurred just before 1300 GMT at the corner of the store and Drottninggatan, the city's biggest pedestrian street, above ground from Stockholm's central subway station.
Thick smoke was rising from the scene, while video images showed an area blocked off by police and crowds gathering around the police cordon.
Police vans circulating in the city using loudspeakers urged people to go straight home and avoid large crowds.
Helicopters could be heard hovering in the sky over central Stockholm, and a large number of police cars and ambulances were dispatched to the scene, witnesses said.
A spokeswoman for transport company Spendrups told AFP that the truck “had been stolen during a delivery to a restaurant.”
Traffic on the Stockholm metro was badly affected, with the attack taking place at the city's T-Centralen station, through which all the city's lines pass.
Latest truck attack in Europe
The attack followed a string of assaults in Europe by people using vehicles as weapons.
The deadliest attack came last year in France on the Bastille Day national holiday of July 14th, when a man rammed a truck into a crowd in the Mediterranean resort of Nice, killing 86 people.
He was shot dead by police, and the Islamic State group later claimed responsibility.
Last month, Khalid Masood, a 52-year-old convert to Islam known to British security services, drove a car at high speed into pedestrians on London's Westminster Bridge before launching a frenzied knife attack on a policeman guarding the parliament building.
The incident killed five people, while Masood himself was shot dead by police.
And in December, a man hijacked a truck and slammed into shoppers at a Christmas market in Berlin, killing 12 people.
That attacker was shot dead by police in Milan four days later, and the rampage was claimed by Isis.
In 2014, Isis spokesman Abu Mohammed al-Adnani called for attacks on citizens of Western countries and gave instructions on how they could be carried out without military equipment, using rocks or knives, or by running people over in vehicles.
There have also been false alerts, however.
Earlier Friday, Belgium dropped terrorism charges against a driver who sped into a crowded shopping area in Antwerp last month, which sparked fears of a copy-cat terror attack.
However, the driver, a Tunisian man identified as Mohamed R., remains in custody on a weapons offence related to the incident, the federal prosecutor's office said.
By Pia Ohlin