Jeanette Manfra of the Department of Homeland Security (DHS) refused to identify the states during her testimony before a Senate panel, citing confidentiality agreements.
But she added there was no evidence to suggest actual vote ballots were altered in the election hack.
US intelligence agencies believe Moscow interfered to help Donald Trump win.
Ms Manfra, the department’s acting deputy undersecretary of cyber security, testified on Wednesday before the Senate Intelligence committee, which is investigating Russia’s alleged meddling in the 2016 election.
“As of right now, we have evidence that election-related systems in 21 states were targeted,” she told the panel.
She said DHS still had confidence in the US voting system because they are “fundamentally resilient”.
The Kremlin has repeatedly denied any involvement in election cyber hacks while Mr Trump has dismissed allegations that his campaign colluded with Russia as “fake news”.
White House Press Secretary Sean Spicer on Tuesday refused to say whether Mr Trump believes Russia interfered in the 2016 election.
“I have not sat down and talked to him about that specific thing,” Mr Spicer said during a daily news briefing.
“Obviously we’ve been dealing with a lot of other issues today. I’d be glad to touch base.”
Senator Mark Warner, a top Democrat on the panel, argued on Wednesday the country was “not any safer” in concealing which states were hit in the hack.
Both Arizona and Illinois last year confirmed that their voter registration systems had been attacked by hackers.
Republican Senator Marco Rubio also expressed concern, adding that as the investigation continues “it is important Americans understand how our voting systems work and communicate that in real time”.
Ms Manfra’s comments echoed earlier testimony by Samuel Liles, acting director of the DHS cyber division.
Mr Liles told Congress DHS detected hacking activities last spring and summer and later received reports of cyber probing of election systems.
But he added: “None of these systems were involved in vote tallying.”
Mr Liles also said “a small number of networks were exploited – they made it through the door.”