William Lynn, the US deputy secretary of defence, said the data was taken from the computers of a corporate defence contractor.
He said the US government had a "pretty good idea" who was responsible but did not elaborate.
Many cyber-attacks in the past have been blamed on China or Russia, and one of the Pentagon's fears is that eventually a terrorist group will acquire the ability to steal data.
Mr Lynn disclosed the March attack in a speech outlining a new cyber-strategy, which formally declares cyberspace a new warfare domain, much like air, land and sea.
It calls for developing more resilient computer networks so the military can continue to operate if critical systems are breached or taken down. (read more)