Investigators accused Daniel Spitler and Andrew Auernheimer of using an "account slurper" to conduct a "brute force" attack over five days last June, to extract data about iPad users who accessed the Internet through AT&T Inc's 3G network.
Among the possible victims were celebrities, businesses executives and government officials such as New York City Mayor Michael Bloomberg, ABC News anchor Diane Sawyer, movie mogul Harvey Weinstein and perhaps then-White House Chief of Staff Rahm Emanuel, prosecutors said.
Spitler, 26, and Auernheimer, 25, were taken into custody by FBI agents on Tuesday morning, U.S. Attorney Paul Fishman in New Jersey said in a statement.
"It is more an issue if you can pair addresses with places of employment, such as government agencies," he added. "Then it becomes possible to collect further information, and perhaps get a toehold into Google, Bing or other information sources."
AT&T was Apple's partner in the United States to provide wireless service on the iPad. After the hacking, it shut off the feature that allowed email addresses to be obtained.
The case "has hopefully awakened users to the value of a simple email address," said Jamz Yaneza, a threat research manager at Internet security company Trend Micro Inc.
The case is U.S. v. Spitler et al, U.S. District Court, District of New Jersey, No. 11-mag-04022.