Morrisons has been found liable for the actions of a former member of its staff who stole the data of thousands of employees and posted it online.
Workers brought a claim against the company after employee Andrew Skelton stole the data, including salary and bank details, of nearly 100,000 staff.
The High Court ruling now allows those affected to claim compensation for the "upset and distress" caused.
The case is the first data leak class action in the UK.
Morrisons said it believed it should not have been held responsible and would be appealing against the decision.
The case follows a security breach in 2014 when Skelton, then a senior internal auditor at the retailer's Bradford headquarters, leaked the payroll data of employees.
More on this and other Yorkshire stories
He posted the information - including names, addresses, bank account details and salaries - online and and sent it to newspapers.
Skelton's motive appeared to have been a grudge over an incident when he was accused of dealing so-called legal highs at work.