WM Morrisons Supermarkets PLC (LON:MRW) on Monday lost its challenge to a High Court ruling that it is liable for a data breach which saw the personal details of thousands of its employees posted online.
The Court of Appeal upheld the original decision against the supermarket group, which was issued in December 2017.
READ: Morrisons challenges court ruling which could see it pay compensation for the actions of a rogue employee
Morrisons staff brought a claim against the company after an employee - Andrew Skelton - stole the data, including salary and bank details, of some 100,000 staff.
Morrisons said it would now appeal to the Supreme Court.
If that appeal fails, those affected will be able to claim compensation for "upset and distress".
It follows a security breach in 2014 when Skelton – an auditor at Morrisons’ Bradford headquarters, leaked the payroll and personal data of employees online and sent it to newspapers.
He was jailed for eight years in 2015 after being found guilty at Bradford Crown Court of fraud, securing unauthorised access to computer material and disclosing personal data.
Shares in Morrisons were 1% down at 247.75p in late afternoon trade.