White House Press Secretary Josh Earnest answers questions on a massive cyberattack against U.S. government employee data, June 5, 2015, at the White House in Washington, D.C. Getty Images

The United States may impose sanctions against individuals and companies in Russia, in addition to China, following cyber attacks to commercial targets, U.S. officials told Reuters on Monday. But no official decision has been made about the sanctions, which could potentially damage the relationship with Russia and cause friction when Chinese President Xi Jinping visits the White House in September.

Foreign spies in China and Russia reportedly attacked U.S. computer databases to target American intelligence personnel, the Los Angeles Times reported Monday. Russian hackers associated with the Kremlin were able to access the State Department's email system for several months last fall, the officials said.

The spies were able to access government websites and emails, social media accounts and personal information on millions of Americans -- including medical forms, Social Security numbers and airline records -- to pinpoint who worked for intelligence agencies.

A massive data breach of government personnel records discovered in April was also believed to be the work of Chinese operatives. The hack involved an estimated 18 million current, former and prospective federal employees at the Office of Personnel Management, but government officials have been reluctant to publicly point fingers at any countries for the hack.

Officials said that a move to enforce sanctions against China before Xi's visit is possible, but unlikely due to the diplomatic nature of the visit. China has maintained that the government had no involvement in the cyberattacks.

“The Chinese government staunchly upholds cybersecurity, firmly opposes and combats all forms of cyberattacks in accordance with law,” Chinese Embassy spokesman Zhu Haiquan said in a statement.

Relations between the U.S. and Russia have been tense since Russia annexed Crimea in March 2014 from Ukraine and the recent cyberattacks put added stress on the relationship.

The official also said that "entities or individuals from other countries" may also be subject to sanctions, Reuters said.