Thousands of players have been sent emails warning of “suspicious activity” on their online accounts.
Lottery organiser Camelot believe around 26,500 player accounts were accessed.
A much smaller number – around 50 – were actually tampered with.
No money has been withdrawn or deposited from affected player accounts and bank details have not been taken, Camelot said.
However, “some of the personal information” held in players” accounts may have been stolen in the attack.
In a statement a spokesperson for lottery organiser Camelot said: “We are currently taking all the necessary steps to fully understand what has happened, but we believe that the email address and password used on the National Lottery website may have been stolen from another website where affected players use the same details.”
Of the thousands of accounts hacked, only 50 were tampered with since being accessed on November 28.
Camelot has suspended all of these accounts as a precautionary measure.
Meanwhile, the holders of the 26,000 accounts affected will be issued with a compulsory password reset.
Camelot said it is in the process of helping customers change their passwords and giving security advice.
Ollie Whitehouse, technical director at global cyber security specialist NCC Group, said: “Although individual breaches like this might seem small or harmless, they could eventually have more serious consequences for individuals who choose to recycle the same passwords.
“The gradual collection of this data is an increasing motivation for hackers and businesses like Camelot should now be doing more to help their customers remain safe.”
A Camelot spokesperson added: “Cyber criminals such as this are persistent, and we are continuing to monitor and protect our systems.
“We are also working closely with the National Crime Agency and the National Cyber Security Centre on an ongoing basis on this criminal matter.
We’d like to reassure our customers that protecting their personal data is of the utmost importance to us.
“We are very sorry for any inconvenience this may cause to our players and would like to encourage those with any concerns to contact us directly, so we can discuss it with them in more detail.”
It comes after Camelot announced a £226million plunge in ticket sales since adding more numbers to its draw.