The message said it suspected that two of its servers containing details of past and present employees had been compromised.
It added that it did not believe any Nasa mission had been put in jeopardy.
One expert noted that this was the latest in a series of breaches experienced by the space agency to have been made public since 2011.
In this case, the memo involved was published by the SpaceRef news site.
It said that a probe into the incidents had been ongoing since 23 October.
"Our entire leadership team takes the protection of personal information very seriously," it said.
"Nasa is continuing its efforts to secure all servers, and is reviewing its processes and procedures to ensure that the latest security practices are being followed throughout the agency."
The email added that social security numbers and other private information belonging to civil service employees of the agency who had worked for it since July 2006, might have been affected.
Previous attacks include an incident in which hackers took control of computers in Nasa's Jet Propulsion Laboratory in 2011, and an attack in 2013 that led to eight Nasa web domains being defaced by a gang calling itself the Master Italian Hackers Team.
"The public want to know that this government agency is learning from the past, we want the post-mortem," commented Sam Curry, chief security officer at Cybereason.
"There are many things at Nasa in the national security domain which are of vital importance."
More about: Nasa
