Swedish authorities said four people were killed and 15 were injured after a suspected Islamist extremist drove a stolen truck down a pedestrian mall before slamming into a department store.
The Foreign Office in London confirmed that a British man, 41-year-old Chris Bevington who was a top executive at Sweden-based music streaming company Spotify, was among the dead in a Swedish terror attack on Friday.
Mr Bevington was a father who was described as "talented, compassionate and caring".
The Belgian foreign ministry also confirmed that a Belgian woman had been killed.
The other two victims were Swedish, one of whom was an 11-year-old girl who was on her way home when the attack happened, her relatives said.
The fourth victim was a Swedish woman, according to local media.
Nine people remain in hospital, four of them seriously injured, according to health authorities.
The attack occurred at 1pm on Friday when a stolen beer truck barrelled for several hundred metres down Drottninggatan, Stockholm's biggest pedestrian street, before slamming into the front of the Ahlens department store.
Witnesses described scenes of panic and horror as authorities quickly sealed off the area.
The attacker fled the scene, with police arresting a suspect later Friday night.
Authorities have yet to name the man suspected of carrying out the attack, but police said Sunday that he was known to have "shown interest for extremist organisations" such as the Islamic State group.
Swedish media on Sunday named the suspect as Rakhmat Akilov, an Uzbek construction worker and father-of-four who went underground to avoid being deported from Sweden.
He had also been refused residency in Sweden, having been warned in December 2016 that he had a month to leave the country.
By February this year, his case was handed over to police, police chief Jonas Hysing told reporters in Stockholm on Sunday.
A second suspect, whose identity was not disclosed, was arrested on Sunday. That person can be detained until Wednesday, at which point prosecutors would have to ask a court for permission to extend their detention.
The Stockholm attack followed a string of similar assaults in Europe using vehicles.
The deadliest came in France on the Bastille Day national holiday in July 2016 when a man rammed a truck into a crowd in the Mediterranean resort of Nice, killing 86 people.
Last month, Khalid Masood, a 52-year-old convert to Islam known to British security services, drove a car at high speed into pedestrians on London's Westminster Bridge before launching a knife attack on a policeman guarding the parliament building.
Five people were killed in the attack, while Masood was shot dead by police.
In 2010, another section of Drottninggatan was the scene of Sweden's only other terror attack, when a suicide bomber blew himself up, slightly injuring several others.