More than 2,000 Morrisons employees are preparing to sue the supermarket chain after their personal data was leaked online.
In 2013, auditor Andrew Skelton uploaded personal and financial information of more than 100,000 Morrisons employees to several file-sharing websites.
Skelton was sentenced to eight years in prison. But the 2,000 workers are now claiming that Morrisons should have protected their data much better.
Morrisons has previously denied any responsibility for the leak, and denied to comment following the news that the workers would sue.
Nick McAleenan, the data privacy lawyer representing the 2,000 workers, said: "My clients' position is that Morrisons failed to prevent a data leak which exposed tens of thousands of its employees to the very real risk of identity theft and potential loss.
"In particular, they are worried about the possibility of money being taken from their bank accounts and - in the case of younger clients - negative consequences for their credit rating."