The supermarket chain has lost a Court of Appeal challenge against a ruling that it was partly liable for the breach, which saw staff details posted online.
Some 5,518 former and current employees said the breach had exposed them to the risk of identity theft and potential financial loss.
They also said Morrisons was responsible for breaches of privacy, confidence and data protection laws.
The High Court ruled in the employees' favour in December but Morrisons had said it could not be held liable for the criminal misuse of data.
The supermarket appealed but this was rejected by the Court of Appeal.