The White House chief of staff is believed to be among 114,000 iPad owners, including chief executives and military officials, whose personal details have been exposed through a breach of the website of the US phone network AT&T.

AT&T acknowledged the leak but said the risk was limited to the subscriber's email address and that the issue had been "escalated to the highest levels of the company". UK customers are not thought to have been affected or to be vulnerable to the same attack.

The names and email addresses of those involved apparently includes Rahm Emanuel, the White House chief of staff, members of the US Senate and House of Representatives, staff at Nasa and the department of homeland security, the New York Times, Viacom, Time Warner, bankers and venture capitalists.

It will be an embarrassment to Apple, which has sold more than 2m of the tablet computers since they went on sale in the US at the start of April, and late last month internationally. The iPad comes in two main versions, one with 3G and one without. The news that the 3G version could have been liable to hacking could depress sales of the more profitable version. It will also increase friction between Apple and AT&T, which has had the exclusive rights to sell the iPhone since 2007, and now the 3G-enabled iPad in the US. The exclusivity is believed to be a five-year deal but many Apple fans have accused AT&T's network of being unable to support their growing demand for bandwidth.

The Gawker website, which says it has seen details of the email addresses – provided in a foot-high printout – suggests that the flaw makes any of those people vulnerable to spam marketing and malicious hacking. The breach was demonstrated by a team of hackers calling themselves Goatse Security, who have previously pointed to weaknesses in web browsers. They were able to use a flaw in the AT&T website to get the email address of any AT&T subscriber by providing a piece of data called an ICC-IDS, used to identify the SIM card belonging to that subscriber.

The team sent data to the site pretending to be each of a huge sequence of ICC-IDS devices, and requested the email address. They say they also shared the knowledge of the hack with others, until AT&T closed the breach a few days ago.

An AT&T spokesman said: "AT&T was informed by a business customer on Monday of the potential exposure of their iPad ICC-IDS. The only information that can be derived from the ICC-IDS is the e-mail address attached to that device. This issue was escalated to the highest levels of the company and was corrected by Tuesday; and we have essentially turned off the feature [on the website] that provided the e-mail addresses.

"The person or group who discovered this gap did not contact AT&T. We are continuing to investigate and will inform all customers whose e-mail addresses and ICC-IDS may have been obtained."

"We take customer privacy very seriously and while we have fixed this problem, we apologise to our customers who were impacted."

Apple did not have any statement.

If the hackers have discovered a flaw that was widespread in AT&T's handling of the ICC-ID system, then it is possible that every owner in the US with an iPhone 3GS or a 3G iPad may have had their email address lifted by the group, and possibly others.

Only iPads which use 3G networking would be vulnerable to the hack, and although any device which uses a SIM will have an ICC-ID, it is not known whether the British networks which provide connectivity for the iPad would have the same flaw as AT&T's website.