Details of a major hack emerged last week, but officials have now given details of a potential second breach.
It is feared that the attack could leave US security personnel or their families open to blackmail.
The agency involved, the Office of Personnel Management (OPM), is yet to comment on the reports.
Officials, who spoke on condition of anonymity to the Associated Press (AP) news agency, believe the attackers have targeted the forms submitted by intelligence and military personnel for security clearances.
The document includes personal information - everything from eye colour, to financial history, to past substance abuse, as well as contact details for the individual's friends and relatives.
A 127-page vetting document called Standard Form 86 may have been accessed. Among the questions potential employees are asked:
A White House statement said investigators had a "high degree of confidence" that background information on government employees had been accessed.
Joel Brenner, a former US counterintelligence official, called the data a "gold mine" for hackers.
It is also believed the breach of personal data of US government workers announced last week may be far larger than previously reported.
Initial estimates put the number of people potentially affected at four million, but officials close to the investigation told AP that as many as 14 million might be involved.
The US has said the hackers, thought to be behind both attacks, are believed to be based in China. Beijing called the claims "irresponsible".
The Obama administration meanwhile announced further measures to beef up cybersecurity on Friday.
"Recent events underscore the need to accelerate the administration's cyber strategy and confront aggressive, persistent malicious actors that continue to target our nation's cyber infrastructure," a White House statement said.

People had gathered on the bridge to watch emergency services rescue a man who had jumped into the Sanvordem river in Curchorem.
Local media reported that more than 50 people were on the bridge when it collapsed late on Thursday evening.
The bridge was reportedly more than 60 years old and was banned from use.
A local police officer told the Hindustan Times that more people were likely to be "trapped under the collapsed bridge".
Home Minister Rajnath Singh said he was also monitoring the rescue operation.
South Goa MP Narendra Sawaikar told the Goa Herald newspaper that "it was an unfortunate tragedy".
"The bridge must be demolished as the government had notified it as a dangerous bridge and notices were placed both the side of the bridge not to use it.
"Right now the priority is to recover the bodies," he added.
Hackers with suspected links to China appear to have accessed sensitive data on US intelligence and military personnel, American officials say.
[NEXT_CONCEPT]
At least two people have died and several others are feared missing after a pedestrian bridge collapsed in the Indian state of Goa.