The Supreme Court on Monday rejected an appeal from Amazon’s online shoe retailer Zappos, a move that will allow a class-action lawsuit over a hack that exposed the personal data of 24 million customers to move forward.

Zappos was seeking to appeal a ruling by a San Francisco-based appeals court that said the lawsuit should continue because the 2012 data breach left customers vulnerable to identity theft and fraud.

{mosads}The high court’s decision flew in the face of business groups who argued the lawsuit should be dismissed because customers could not prove substantial harm.

Zappos, with support from organizations like the U.S. Chamber of Commerce, argued that data breach litigation is “sprawling and costly.”

“The factual scenario this case presents – a database holding customers’ personal information is accessed, but virtually no identity theft or fraud results – is an increasingly common one,” Zappos argued in its appeal to the Supreme Court.

Around two dozen consumers said their data was misused following the breach, Zappos said.

After the breach, multiple Zappos customers filed proposed class-action lawsuits, saying the Amazon subsidiary had not done enough to protect its servers and customers.

A federal judge in Nevada ruled that customers who claimed financial losses should be allowed to sue, but those who could not substantiate concrete injuries should not sue.