Police say the men were arrested after a search in County Armagh on Saturday
The data was accidentally shared last month and included the surname and initials of 10,000 PSNI employees.
Police said the men, aged 21 and 22, had been arrested under the Terrorism Act after a search in Portadown, County Armagh, on Saturday.
The pair are currently being questioned at Musgrave police station in Belfast.
To date, four arrests have been made in relation to the data breach.
On 16 August, a 39-year-old was arrested on suspicion of collection of information likely to be useful to terrorists. He was later released on bail.
A 50-year-old man was arrested on 18 August and was subsequently charged with terrorism offences.
He appeared in court on 21 August and was remanded in custody for four weeks.
‘Dealt with robustly’
Dt Ch Insp Avine Kelly said the PSNI was working to establish who possessed information related to the data breach.
“We will take action to ensure that any criminality identified is dealt with robustly to keep communities, and our officers and staff who serve them, safe.”
On 8 August, employees’ details were mistakenly published online after being released by the PSNI in response to a Freedom of Information (FoI) request.
They were taken down from a website at the PSNI’s direction a short time later.
Police have confirmed the list is in the hands of dissident republicans, amongst others.
It was one of three separate PSNI data breach incidents being examined by police.
On 6 July, in an unrelated incident, a police-issue laptop and radio, as well as a document containing the names of more than 200 staff, were stolen from a private vehicle in Newtownabbey, County Antrim.
In another incident, on Thursday 17 August, a PSNI laptop and a police officer’s notebook fell from the roof of a moving car on the M2 in Belfast.
