MORRISONS faces a vast bill for compensation after losing a legal fight over a huge data hack.

The Court of Appeal backed an earlier ruling that the supermarket chain is liable for the breach which saw staff names, addresses, bank details and salaries posted online.

A group of 5,518 ex and current employees brought the claim after Andrew Skelton, a senior auditor at the group’s Bradford headquarters, stole the data.

He was jailed for eight years in 2015.

Morrisons will appeal to the Supreme Court. If that fails, those affected can claim compensation for upset and distress. The case is the first data leak class action in the UK.

Morrisons had argued it could not be held liable for the criminal misuse of its data. But three Appeal Court judges said they agreed with the High Court’s earlier decision that Morrisons was “vicariously liable”.

Anya Proops QC told the court Morrisons now faced “compensation claims on a potentially vast scale”.

Nick McAleenan of JMW Solicitors, who is representing the claimants, said they were “delighted” with the latest outcome.