Some of the passwords that Defense Secretary Pete Hegseth used to register for websites were exposed in cyberattacks on those sites and are available on the internet, raising new questions about his use of personal devices to communicate military information.

Hegseth did not appear to use those passwords for sensitive accounts, like banking. But at least one password appears to have been used multiple times for different personal email accounts maintained by Hegseth. If hackers gain access to email accounts, they can often reset other passwords.

Like many Americans, Hegseth appears to have reused passwords to remember them more easily. At least one of them is, or was, a simple, lowercase alphanumeric combination of letters followed by numbers, potentially representing initials and a date. The same password was leaked in two separate breaches of personal email accounts, one in 2017 and another in 2018.

It is not clear whether he has updated the compromised passwords or if he did so before he used his personal phone in March to share sensitive information about planned U.S. strikes on Houthi militia targets in Yemen.

Hegseth’s digital practices and security have been under scrutiny since he discussed the precise timing of those airstrikes in at least two chats on Signal, a free, encrypted messaging app. At least one of the chats took place on his personal phone. That information could have endangered U.S. pilots if an adversarial power had intercepted it.

In addition to those two Signal chats, Hegseth used the encrypted app for multiple other ongoing conversations and group messages, according to people briefed on his use of the platform. Some of the messages were posted by a military aide, Col. Ricky Buria, who had access to Hegseth’s personal phone. The use of the app for multiple ongoing conversations was earlier reported by The Wall Street Journal.

Hegseth was initially added to a Signal group created by Michael Waltz, who was the national security adviser at the time, to discuss the Houthi strikes. Hegseth shared similar details about the strikes with a second Signal group that included his wife, Jennifer. That group was set up on Hegseth’s personal phone.

Cybersecurity experts have said that because Hegseth’s phone number is easy to find on the web, it is a potential target for hackers and foreign intelligence agencies.

Signal messages are sent across the internet securely, but messages typed into a phone could be intercepted if an adversarial intelligence agency has installed malware on the device.

When two-factor authentication is enabled on the sites, hackers will need more than passwords to gain access to information.

The chief Pentagon spokesperson, Sean Parnell, did not respond to a request for comment.

Experts say that finding exposed passwords is easier than ever.

“If you know where to look, you can find them,” said Kristin Del Rosso, who monitors breach data at DevSec, a cybersecurity investigations firm.

Del Rosso said some companies collect and sell stolen data. Because data breaches are now almost routine, there is a large amount of data that adversaries or criminals could use to get a deeper understanding of an individual and potentially guess other passwords or gain access to more information.

“You can uncover more,” she said.

Passwords belonging to Waltz, who was removed as national security adviser Thursday, have also been exposed in internet breaches.

Representatives of the National Security Council did not respond to a request for comment. But a person briefed on the situation said Waltz had changed his compromised passwords before joining Congress in 2019.

In March, Der Spiegel, a German news publication, found phone numbers and email addresses associated with Waltz, Hegseth and Tulsi Gabbard, the director of national intelligence, who were all on the initial Signal chat.

The phone numbers online for Gabbard are no longer associated with her.

But like Hegseth, Gabbard has reused passwords.

The New York Times found at least one leaked password linked to multiple personal accounts used by Gabbard.

According to a spokesperson, Gabbard’s passwords have been changed many times since a breach exposed a password nearly a decade ago.

The Times uncovered more recent data breaches involving a similar reused password tied to her personal email account.