A suspect is in custody, Boulder Police Chief Maris Herold said, but authorities did not share any information on his identity, the type of weapon used or any possible motive.
"We will work around the clock to get this accomplished," she said, adding that such a complex investigation will take at least five days to complete.
The fatal shooting at the King Soopers store comes less than a week after shooting attacks at three spas in the Atlanta area left eight people dead.
While Boulder police investigate Monday's massacre, witnesses shared their experience with the terror and panic inside the store.
Steven McHugh said his son-in-law and two granddaughters were there when a gunman attacked.
His son-in-law, Paul, was third in line for a Covid-19 vaccine and his seventh- and eighth-grade granddaughters were on the phone with their grandmother. On the other end of the phone, their grandmother heard at least eight shots ring out.
The woman at the front of the line was shot, McHugh told CNN's Don Lemon. Paul grabbed the girls and hurried them upstairs to take cover in a coat closet above the pharmacy, he said.
The girls said they were afraid because the coats weren't long enough to hide.
"The intensity, the awfulness is going to last for the rest of their lives," he said.
Ryan Borowski told CNN he was shopping at the store when he heard the first shots, and by the third one, everyone was running. He said he couldn't believe it happened in his town.
"Boulder feels like a bubble, and the bubble burst," Borowski said. "This feels like the safest spot in America, and I just nearly got killed for getting a soda and a bag of chips."
He added: "It doesn't feel like there's anywhere safe anymore."
The slain officer, 51-year-old Eric Talley, was one of the first to respond to the scene, according to Herold. Talley had joined the Boulder police force in 2010, she said.
"He was, by all accounts, one of the outstanding officers of the Boulder Police Department, and his life was cut far too short," Boulder County District Attorney Michael Dougherty said.
Officials did not disclose the identity of any of the other victims, saying they needed to first notify family members.