According to court documents, Amjid Khan was working at a Morrisons petrol station in Birmingham in 2008 when he punched and kicked Ahmed Mohamud.
Mr Mohamud died in 2014 of an illness not related to the incident, and his family continued his legal fight.
Morrisons said Mr Khan had been sacked and that it had agreed to pay damages.
The court ruled that Morrisons was "vicariously liable" for Mr Khan's actions.
The attack happened in Small Heath, Birmingham, in March 2008, as Mr Mohamud was on his way to London for a demonstration against the war in Somalia.
At the petrol station he asked staff to print some documents he had stored on a USB memory stick.
Court documents say he asked this as a "favour", and Mr Khan responded by being abusive and using a racial slur.
Mr Mohamud was not abusive in return, but the documents say Mr Khan followed him to his car, shouted more abuse, punched him twice in the head then leapt on him and subjected him to a "brutal attack involving punches and kicks while Mr Mohamud was curled up on the petrol station forecourt".
By BBC legal correspondent Clive Coleman
The Supreme Court has sent employers a wake-up call.
It has broadened the law which holds employers vicariously liable for the acts of their employees who commit a crime whilst at work.
Previously an employer could argue that an employee was acting for entirely personal reasons - lawyers call it being "on a frolic of their own" if they committed a crime.
It was only in cases where the employment itself involved a risk that a crime could be committed that employers had been held liable - so for instance in cases involving nightclub bouncers or wardens at residential care homes.
This ruling makes it easier for customers of a business who are assaulted by staff - or affected by staff who commit any unlawful act whilst on duty - to hold the employer business liable.
It is also likely to affect cases involving assaults or harassment by co-workers while at work.
In his case for compensation, Mr Mohamud claimed he suffered psychological injuries and a head injury which led to epilepsy.
BBC legal correspondent Clive Coleman said the court had to consider two key points - the nature of the job entrusted to Mr Khan, and whether there was a sufficient connection between the role and his wrongful conduct to make it right for the employer to be held responsible.
"The court found that the nature of the job was to be viewed broadly," our correspondent said.
"In this case it was Mr Khan's job to attend to customers and respond to their inquiries. His response to Mr Mohamud's inquiry with abuse was inexcusable, but interacting with customers was within the scope of his job."
In a statement, Morrisons said: "When this appalling incident happened we were horrified and dismissed Amjid Khan.
"We then offered a settlement option to Mr Mohamud but he and his legal team wanted to progress a case which involved widening the rules on vicarious liability - where a company can be held liable for the actions of an individual member of staff.
"While the Supreme Court has not changed the law on vicarious liability we accept that it has now said we should now pay the previously agreed damages."
The ruling gave no detail of any criminal proceedings which might have resulted from the incident.
Morrisons supermarket is liable for the actions of a staff member who physically attacked a customer, the Supreme Court has ruled.