The U.S. Supreme Court turned away an appeal by Amazon.com Inc.’s Zappos unit, letting a lawsuit proceed over a 2012 hack that exposed the personal information of 24 million customers.

The online shoe and clothing retailer argued unsuccessfully that the customers couldn’t sue without proof of concrete injury, such as the impending misuse of their information. The suit, allowed by a San Francisco-based federal appeals court, seeks class action status.

The rebuff is a setback for business groups, which urged...