The first & accepted answer on this question about passwords management suggests to encrypt the user identifiers in DB. The good point is that if anyone gets a password, he has to know how to decrypt the user login to get the full login/password pair.

How secure should a username be?

Your username should be simple enough to remember but hard to guess. Never use easy-to-guess numbers with your usernames (for example, address or date of birth). Don't use your Social Security number or ID number as your username.

Is username confidential?

On their own, usernames and login IDs are not Privately-Identifiable Information (PII). They are insufficient on their own to identify a person. However, in our interconnected world, PII leakage across a number of sites can facilitate identifying a person with simply a username.