A man and a woman were killed in a terror attack in London carried out by an Islamist extremist who had been jailed for an al-Qaida inspired bomb plot and was recently released on licence.

Scotland Yard are investigating how 28-year-old Usman Khan was able to launch the attack in London Bridge on Friday, despite being known to the authorities and fitted with an electronic tag to monitor his movements. He was allowed out a year ago after serving time for his part in a plot to blow up the London Stock Exchange.

In the early hours of Saturday, officers confirmed earlier reports that Khan began his attack inside Fishmongers’ Hall, near the north end of the bridge, during a University of Cambridge-organised conference on rehabilitating offenders. Officers believe he acted alone.

“The circumstances, as we currently understand them, are that the attacker attended an event earlier on Friday afternoon at Fishmongers’ Hall called ‘Learning Together’. We believe that the attack began inside before he left the building and proceeded onto London Bridge, where he was detained and subsequently confronted and shot by armed officers,” said the Met police assistant commissioner, Neil Basu.

The two people who died have not yet been named. A man and two women were also injured. The casualties were taken to the Royal London hospital in Whitechapel, one of the capital’s four designated major trauma centres. NHS England said on Friday night that one of the three injured was critical but stable, a second was stable and a third had suffered less serious injuries.

Prof Stephen Toope, the university’s vice-chancellor, said he was “devastated” that an event organised by its Institute of Criminology was targeted in the attack. “We are in touch with the Metropolitan police, and awaiting further details of the victims. We mourn the dead and we hope for a speedy recovery for the injured. Our thoughts are with all their families and friends.”

Khan was one of nine members of an al-Qaida-inspired terror group convicted of plotting to bomb the Stock Exchange and build a terrorist training camp in Pakistan that was disrupted by MI5 and the police. He is also understood to have been a supporter of al-Muhijaroun, the extremist group which scores of terrorists were involved with, according to the anti-extremism group Hope Not Hate.

He was originally given an indeterminate sentence, with a minimum term of eight years in February 2012. This was replaced by a 16-year fixed-term sentence and an extended period on licence by the court of appeal in 2013.

In his judgment at the time, Lord Justice Leveson said: “There is no doubt that anyone convicted of this type of offence could legitimately be considered dangerous.

“There is an argument for concluding that anyone convicted of such an offence should be incentivised to demonstrate that he can safely be released; such a decision is then better left to the Parole Board for consideration proximate in time to the date when release becomes possible.”

Khan spent more than a year on remand and then about seven years more behind bars after sentencing, before being released in December 2018 at about the halfway point. “Clearly, a key line of enquiry now is to establish how he came to carry out this attack,” Basu said on Friday night. He had been living in Staffordshire and police were focusing their searches at an address in the county.

Police have said Khan was wearing a fake suicide vest when he was shot. The incident played out in extraordinary scenes that prompted praise for the bravery of members of the public and police. In footage captured by bystanders, civilians were seen wrestling with a person lying on the ground at the northern end of the bridge, before being pulled to safety by armed police arriving at the scene.

Khan, dressed in black, then appeared to try to rise, before firearms officers fired two shots. One man wearing a suit appeared to have removed a large knife from the suspect before the shots were fired, and was filmed running down the road away from the scene gesturing at others to get back.There were reports that one man had taken a five-foot long narwhal tusk from Fishmongers’ Hall to confront the attacker.

Police had earlier confirmed Khan died at the scene. In a statement on Friday night, the Metropolitan police commissioner, Cressida Dick said the attack from start to finish lasted five minutes.

Play Video Man tackled on London Bridge before being shot dead by police - video

Boris Johnson, who returned to Downing Street from his constituency, said the emergency services and members of the public who intervened “represent the very best of our country”.

The prime minister said: “This country will never be cowed or divided or intimidated by this sort of attack and our values, our British values, will prevail.” Downing Street said the prime minister chaired a meeting of the government’s emergency response committee, known as Cobra, on Friday evening.

Political parties said they would be suspending campaigning for the general election on Saturday. But before the Cobra meeting, Johnson made an apparent bid for political mileage from the incident, claiming he had “long argued” that it is a “mistake to allow serious and violent criminals to come out of prison early and it is very important that we get out of that habit and that we enforce the appropriate sentences for dangerous criminals, especially for terrorists, that I think the public will want to see”.

The incident, the first deadly attack in Great Britain since 2017, came just three weeks after the national terrorist threat level was lowered from “severe” to “substantial”.

London Bridge attack: police and public were heroic, says mayor Read more

Due to initial reports that the suspect might have had an explosive device, wide cordons were in place to ensure there was no further danger to the public, Basu said.

The incident, which sparked panicked scenes as crowds ran from the bridge and took shelter in nearby buildings, had echoes of the terrorist attack on the bridge in June 2017, in which eight people died excluding the attackers.

On that occasion, terrorists drove a van into crowds crossing the bridge before attacking others with knives there and in neighbouring pubs and restaurants. Police shot three Islamist terrorists dead and they were found to be wearing fake suicide vests.

Play Video 1:17 'Then the police officer shot him': witnesses describe London Bridge attack - video

The shooting of Khan will now be investigated by the Independent Office for Police Conduct. By law, it has to examine all police shootings.

Johnson thanked the emergency services and members of the public, and said in a tweet: “This is an appalling incident and all my thoughts are with the victims and their families.” He returned to central London from his constituency to be personally briefed by Basu and Dick.

Jeremy Corbyn tweeted: “Shocking reports from London Bridge. My thoughts are with those caught up in the incident. Thank you to the police and emergency services who are responding.”

One woman from New York, who gave her name only as Aditi, said she had hidden in the attic of a cheese shop in nearby Borough Market when she noticed people running from the bridge.

Tell us: have you been affected by the London Bridge attack? Read more

“We ran down a side street and noticed people running into Neal’s Yard Dairy,” she told the Guardian. “We were one of the last to get in before they locked the door. We were taken to the attic and the staff said they had been trained for such an incident. We were there for around 30 minutes before the police gave clearance to exit and move further away from the market. My partner and I are rattled but OK. We’re just glad to be safe.”

Another woman called Jo from east London said she had been in the market when people started to panic and run. “I saw two people fall over. The police then told people to get inside, so we sheltered in Le Pain Quotidien. They locked the doors and moved people away from the glass.”

More than 20 witnesses were taken to be debriefed at the police-allocated building near the incident. Some of them looked shaken as they entered the building.

More arrived in marked and unmarked police vehicles as the afternoon wore on, including restaurant and transport workers. None were willing to talk to reporters.

Additional reporting: Sarah Marsh, Denis Campbell, Haroon Siddique, Rachel Obordo

• This article was amended on 2 December 2019 to clarify that it was the first deadly attack in Great Britain since 2017, not the UK as stated in an earlier version.