Defense Secretary Pete Hegseth’s personal phone number, the one used in a recent Signal chat, was easily accessible on the internet and public apps as recently as March, potentially exposing national security secrets to foreign adversaries.

The phone number could be found in a variety of places, including WhatsApp, Facebook and a fantasy sports site. It was the same number through which the defense secretary, using the Signal commercial messaging app, disclosed flight data for American strikes on the Houthi militia in Yemen.

Cybersecurity analysts said an American defense secretary’s communications device would usually be among the most protected national security assets.

“There’s zero percent chance that someone hasn’t tried to install Pegasus or some other spyware on his phone,” Mike Casey, the former director of the National Counterintelligence and Security Center, said in an interview. “He is one of the top five, probably, most targeted people in the world for espionage.”

Emily Harding, a defense and security expert at the Center for Strategic and International Studies, added: “You just don’t want the secretary of defense’s phone number to be out there and available to anyone.”

The chief Pentagon spokesman, Sean Parnell, did not respond to request for comment.

Mr. Hegseth’s use of Signal to convey details of military strikes in Yemen first surfaced last month when the editor of The Atlantic wrote an article that said he had been added, apparently accidentally, to an encrypted chat among senior U.S. government officials. The New York Times reported this week that Mr. Hegseth included sensitive information about the strikes in a Signal group chat he set up that included his wife and brother, among others.

Soon after the first Signal chat about Yemen became public in March, Der Spiegel, the German news publication, found the phone numbers of Mr. Hegseth and other senior Trump officials on the internet.

That Mr. Hegseth’s private cellphone number was easily available through commercial providers of contact information is not surprising, security experts said. After all, Mr. Hegseth was a private citizen until Donald J. Trump, who was then the president-elect, announced that he wanted the former National Guardsman and Fox News weekend anchor to run the Pentagon, an $849 billion-a-year enterprise with close to three million employees.

It has now become routine for government officials to keep their personal cellphones when they enter office, several defense and security officials said in interviews. But they are not supposed to use them for official business, as Mr. Hegseth did.

Even low-level government workers are instructed not to use their personal cellphones and laptops for work-related matters, according to current and former government officials, who spoke on the condition of anonymity to discuss sensitive information.

For senior national security officials, the directive is even more crucial, one former senior Pentagon official said.

Mr. Hegseth had a significant social media presence, a WhatsApp profile and a Facebook page, which he still has.

On Aug. 15, 2024, he used his personal phone number to join Sleeper.com, a fantasy football and sports betting site, using the username “PeteHegseth.” Less than two weeks later, a phone number associated with his wife, Jennifer, also joined the site. She was included in one of the two Signal chats about the strikes.

Mr. Hegseth also left other digital breadcrumbs, using his phone to register for Airbnb and Microsoft Teams, a video and communications program.

Mr. Hegseth’s number is also linked to an email address that is in turn linked to a Google Maps profile. Mr. Hegseth’s reviews on Google Maps include endorsements of a dentist (“The staff is amazing”), a plumber (“Fast, honest, and quality work”), a mural painter (“Painted 2 beautiful flags for us — spot on”) and other businesses. (Google Maps street view blurs out Mr. Hegseth’s former home.)

“If you use your phone for just ordinary daily activities, you are leaving a highly, highly visible digital pathway that even a moderately sophisticated person, let alone a nefarious actor, can follow,” said Glenn S. Gerstell, a former general counsel for the National Security Agency.

Government cellphones, by contrast, are far more secure because they are fitted with rigorous government controls meant to protect official communications.

In using that same phone number on Signal to discuss the exact times that American fighter pilots would take off for strikes in Yemen and other sensitive matters, Mr. Hegseth opened himself — and, potentially the pilots — to foreign adversaries who have demonstrated their abilities to hack into accounts of American officials, encrypted or not, security experts said.

“Phone numbers are like the street address that tell you what house to break into,” said James A. Lewis, a cybersecurity expert. “Once you get the street address, you get to the house, and there might be locks on the doors, and you ask yourself, ‘Do I have the tools to bypass or break the locks?’”

China and Russia do, and Iran may as well, several cybersecurity experts said.

Last year a series of revelations showed how a sophisticated Chinese intelligence group, called Salt Typhoon, penetrated deep into at least nine U.S. telecommunications firms. Investigators said that among the targets were the commercial, unencrypted phone lines used by Mr. Trump, Vice President JD Vance and top national security officials.

Mr. Gerstell said he had no knowledge of Mr. Hegseth’s phone or if it was subject to attack. But personal phones are typically far more vulnerable than government-issued phones.

“It would be possible, with moderate difficulty for someone to take over a phone in a surreptitious way once they had the number assuming you clicked on something malicious,” Mr. Gerstell said. “And when really sophisticated bad guys are involved, like Russia or China, phones can be infected even if you don’t click on anything.”

Cybersecurity experts said that more than 75 countries had acquired commercial spyware within the past decade. The most sophisticated spyware tools — like Pegasus — have “zero-click” technology, meaning they can stealthily and remotely extract everything from a target’s mobile phone, without the user having to click on a malicious link to give Pegasus remote access. They can turn the mobile phone into a tracking and secret recording device, allowing the phone to spy on its owner.

Signal is an encrypted app, and its security for a commercial messaging service is considered very good. But malware that installed a key logger or keystroke capture code on a phone would allow the hacker, or nation state, to read what someone types into a phone, even in an encrypted app, former officials said.

In the case of Mr. Hegseth’s use of Signal to discuss the Yemen strike plans, spyware on his phone could potentially see what he was typing or reading before he hit “send,” because Signal is encrypted during the moments of sending and receiving, cybersecurity experts said.

One person familiar with the Signal conversation said that Mr. Hegseth’s aides warned him a day or two before the Yemen strikes on March 15 not to discuss such sensitive operational details in his group chat. That chat, while encrypted, was not considered as secure as government channels.

It was unclear how Mr. Hegseth responded to those warnings.

Mr. Hegseth also had Signal set up on a computer in his office at the Pentagon so that he could send and receive instant messages in a space where personal cellphones are not permitted, according to two people with knowledge of the matter. He has two computers in his office, one for personal use and one that is government-issued, one of the people with knowledge of the matter said.

“I guarantee you Russia and China are all over the secretary of defense’s cellphone,” Representative Don Bacon, Republican of Nebraska, who has suggested that Mr. Hegseth should be fired, told CNN this week.

Christiaan Triebert reported from New York. Greg Jaffe in Washington contributed reporting and Sheelagh McNeill contributed research.

Pete Hegseth, the newly confirmed defense secretary, has pledged to restore “the warrior ethos” to the U.S. military, which he believes has been weakened by its diversity.

His view that the military has diminished its standards in welcoming women and racial minorities might run into resistance as he takes the reins at the Pentagon, which sees its diversity as an asset and has tried to build a force that mirrors America.

Mr. Hegseth has said that standards were “lowered” as women began serving in combat positions. But he will be met by the more than 10,000 women who currently fill combat roles, from artillery and infantry positions to combat engineers and even a few Green Berets and Army Rangers.

He has vowed to “address the recruiting, retention and readiness crisis in our ranks” and to bring “lethality” back to the Pentagon. But the military has been focused on those issues for years.

“The whole Department of Defense will be ready to focus on lethality when he walks through that door, and is not going to fight him on that,” Peter Feaver, a political science professor at Duke University who has studied the military for decades, said in an interview.

Mr. Hegseth, an Army combat veteran and former Fox News host, has delivered right-wing talking points in his criticism of the military in podcast appearances and in his book, “The War on Warriors.”

“Affirmative action posts have skyrocketed, with ‘firsts’ being the most important factor in filling new commanders,” he wrote in his book, criticizing the military for being too “woke.” “We will not stop until trans-lesbian Black females run everything.”

But in his aim to reshape a military with three million employees, Mr. Hegseth, 44, faces a daunting challenge. The $849 billion enterprise has 1.3 million active-duty service members and 750 military bases around the globe. People of color make up about 43 percent of the work force.

“He may quickly discover that to retain the high caliber of people he wants, that he will have to reach out to women,” Mr. Feaver said. “He may find that some of his best people are women and Black males,” he said, and other people of color.

In a message to the Defense Department on Saturday, Mr. Hegseth outlined his main priorities. In addition to reviving “the warrior ethos,” he emphasized strengthening the nation’s industrial base and streamlining the military’s cumbersome processes for buying new weapons.

He also said the Pentagon would “re-establish deterrence by defending our homeland” and working with allies to confront a rising military threat from China.

In his Senate hearing, Mr. Hegseth acknowledged that he had never managed more than a few hundred people at a time. But he cast his unconventional background — his predecessors have been former generals, lawmakers or government officials — as an advantage in President Trump’s drive to shake up the establishment.

Mr. Hegseth also made clear that he believed that Mr. Trump’s Electoral College and popular-vote victory gave the president a mandate to carry out his agenda. Indeed, even before the Senate vote on Friday night approving Mr. Hegseth’s nomination, the Pentagon had announced it would rush 1,500 active-duty Marines and Army soldiers to the southwestern border to help thwart migrants entering the country, one of Mr. Trump’s main policy objectives.

Mr. Hegseth was confirmed on a 51-to-50 vote, the smallest margin for a defense secretary’s confirmation since the position was created in 1947, according to Senate records. Vice President JD Vance had to cast a tiebreaking vote after three Republicans joined all Democrats in voting no.

One of those Republicans, Senator Mitch McConnell of Kentucky, cited Mr. Hegseth’s lack of strategic insights as among his reasons for opposing him. “Mr. Hegseth provided no substantial observations on how to defend Taiwan or the Philippines against a Chinese attack, or even whether he believes the United States should do so,” Mr. McConnell said in a statement on Friday. “He failed, for that matter, to articulate in any detail a strategic vision.”

Mr. McConnell also took a dim view of the claim that Mr. Hegseth would restore “a warrior culture” to the armed forces. “The restoration of ‘warrior culture’ will not come from trading one set of culture warriors for another,” he said.

Most defense secretaries, with the exception of Chuck Hagel in 2013, have sailed through their confirmation votes. President Joseph R. Biden Jr.’s defense secretary, Lloyd J. Austin III, was confirmed on a 93-to-2 vote. The Senate voted 98 to 1 to confirm Jim Mattis, Mr. Trump’s first Pentagon chief, and 90 to 8 for his successor, Mark T. Esper.

Traditionally, both parties have espoused the belief that the military should be nonpartisan. Commanders in chief usually appoint defense secretaries who have the ability to gain support from Democrats and Republicans at Pentagon budget time, as well as from the public.

But for 30 minutes on Friday night, after all 100 senators had voted, Mr. Hegseth’s confirmation tally stood at 50 to 50, a stark display of the demise of the apolitical military.

And many of the Democrats who voted against him insist he is unfit for duty.

Senator Jack Reed of Rhode Island, the Armed Services Committee’s top Democrat, said he was unswayed by Mr. Hegseth’s testimony at his confirmation hearing, which focused on a sexual assault allegation and accusations of alcohol abuse and financial mismanagement.

“He lacks the requisite character, competence and commitment to do this job,” Mr. Reed said after the hearing. “Indeed, he is the least-qualified nominee for secretary of defense in modern history.”

Mr. Hegseth has denied the sexual assault accusation, saying the encounter was consensual, and he was never charged with a crime. He labeled the allegations against him “anonymous smears.”

Mr. Hegseth’s remarks have already had a chilling effect on the military’s highest uniformed ranks.

In his confirmation hearing, he pledged that “every single senior officer will be reviewed based on meritocracy, standards, lethality and commitment to lawful orders they will be given,” opening the door to a political purge of generals and admirals.

The first to fall under Mr. Trump was the Coast Guard commandant, Adm. Linda L. Fagan, the first female uniformed leader of a branch of the armed forces. Among the reasons she was pushed out was an “excessive focus on diversity, equity and inclusion,” according to a statement from the Homeland Security Department.

The admiral was told on the evening of President Trump’s inauguration that she had been fired, as she was waiting to have a photo taken with Mr. Trump at the Commander in Chief Ball, a military official said.

Even some of Mr. Hegseth’s staunchest congressional supporters have warned against a witch hunt in the senior ranks that could cause morale to plunge.

“There’s been a lot of talk about firing ‘woke’ generals,” said Senator Kevin Cramer, Republican of North Dakota. “I would say give those men and women a chance under new leadership.”

Republican leaders embraced Mr. Hegseth’s outlook as they cheered his confirmation. “Peace through strength is back under President Trump and Pete Hegseth,” Senator Roger Wicker, Republican of Mississippi and the chairman of the Armed Services panel, said in a statement after the vote.

Mr. Feaver, the Duke professor, suggested that Mr. Hegseth would find a military that has not run away from the lethality, recruitment and readiness issues that he has highlighted.

In fact, Gen. Charles Q. Brown Jr., the chairman of the Joint Chiefs of Staff, has prioritized those issues for years. Mr. Hegseth has suggested that General Brown, a four-star fighter pilot with decades of military experience, should be fired.

General Brown, known as C.Q., was the Air Force chief of staff before becoming the chairman, and he spoke about lethality and readiness in a 2021 recruiting video. “When I’m flying, I put my helmet on, my visor down, my mask up,” he says, to footage of American fighter pilots strapping into warplanes. “You don’t know who I am, whether I’m African American, Asian American, Hispanic, white, male or female.”

“You just know I’m an American airman, kicking your butt,” he continues. “I’m General C.Q. Brown Jr. Come join us.”