Jeanette Manfra, the department's acting deputy undersecretary of cyber security, would not identify which states had been targeted , citing confidentiality agreements. She reiterated that there was no evidence that any actual votes were manipulated.
"As of right now, we have evidence that election-related systems in 21 states were targeted ," Manfra told the Senate Intelligence Committee, which investigating Russia's meddling in the 2016 presidential election . Systems were breached in a smaller number of states, she said, but did not give a specific figure.
Department officials had said about 20 states had been probed by hackers working on behalf of the Russian government, but recent news media reports had suggested the number could have been far higher.
Mark Warner, the top Democrat on the Senate panel, expressed frustration at Manfra's refusal to identify which states had been targeted .
"I just fundamentally disagree," he said.
Warner on Tuesday sent a letter to Homeland Security Secretary John Kelly asking the agency to disclose more information about hacking attempts on state and local election systems.
US intelligence agencies concluded that the Kremlin orchestrated a wide-ranging influence operation that included email hacking and online propaganda in order to discredit Democratic presidential candidate Hillary Clinton and help Donald Trump, a Republican, win the White House.
Manfra and other officials testifying on Wednesday reiterated that US elections are resilient to hacking in part because they are decentralized and largely operated on the state and local level.
Senator Angus King, an independent from Maine who caucuses with the Democrats, expressed skepticism at that assertion, saying only a small amount of votes in key battleground states would need to be altered to tip the scales of an election .
"A sophisticated actor could hack an election simply by focusing on certain counties," King said. "I don't think it works just to say it’s a big system and diversity will protect us."
Russia has repeatedly denied responsibility for any cyber attacks during the US presidential election . Trump has inconsistently said Russia may or may not have been responsible for the hacking but has dismissed allegations that his associates colluded with Moscow as "fake news."