According to the governor, the employees could be fired for distributing personal and confidential records. They may also face criminal charges.
The list which includes 1,300 names and sensitive personal information including addresses, birth dates and Social Security numbers, as well as the due dates for six pregnant women on the list.
A letter accompanying the list called for the deportation of everyone on it.
None of Utah's anti-immigration groups have claimed responsibility for the list.
The governor, Gary Herbert (R), had ordered an investigation among all state agencies to see if the information came from an employee. The investigation focused heavily on the Department of Workforce Services, which handles applications for Medicaid and food stamps.
Federal agencies were also investigating the incident.
Late update: The director of Workforce Services said today that two more employees are suspected of being involved.
And the attorney general, Mark Shurtleff, said he's working with federal authorities to determine whether to press charges in state or federal court.
"We're talking serious crimes that could rise to the level of what we would call a felony crime," Shurtleff said.