WH Smith said the attack has seen hackers access company data including current and former employee information.
It said the hack has not impacted its trading activities and stressed its website, customer accounts and customer databases are on separate, unaffected separate systems.
WH Smith said: “Upon becoming aware of the incident, we immediately launched an investigation, engaged specialist support services and implemented our incident response plans, which included notifying the relevant authorities.
“WH Smith takes the issue of cyber security extremely seriously and investigations into the incident are ongoing.
“We are notifying all affected colleagues and have put measures in place to support them.”
This is the most recent in a wave of cyber attacks in the past few months, with Royal Mail’s international postal service suffering lengthy disruption after hackers targeted the group.
Retailer JD Sports also warned in January that around 10 million people might have had personal information including their addresses, phone numbers and email addresses stolen in a hack.