Supermarket giant Morrisons faces a potentially "vast" payout after losing a challenge against a ruling which gave the go-ahead for compensation claims by thousands of staff whose personal details were posted on the internet.
Three Court of Appeal judges in London announced their decision yesterday on the issue of liability in the latest round of the first data leak class action in the UK.
Litigation was launched after a security breach in 2014 when Andrew Skelton, a senior internal auditor at the retailer's Bradford headquarters, leaked the payroll data of around 100,000 employees.
Information included their names, addresses, bank account details and salaries.
A group of 5,518 former and current employees said this exposed them to the risk of identity theft and potential financial loss and that Morrisons was responsible for breaches of privacy, confidence and data protection laws.
They are seeking compensation for the upset and distress caused in a case with potential implications for every individual and business in the country.