It would depend on the relationship between the company and the person(s) harmed: is there a duty of care, where they were negligent? Suppose the matter is that a PCA was stealing patient property; the hospital knew of this, and did nothing about it. It is likely that a lawsuit in such a case would succeed, on the premise that patients have entrusted their property with the hospital, and the hospital not only failed to exhibit ordinary care in safeguarding the property, they even went beyond mere negligence and were willful in their disregard (I'm assuming that they ignored the situation and not that they were unknowing, but what they knew would be important). It would not matter if the higher-level policy were to aggressively pursue such thefts and the problem were simple one supervisor, because the hospital will be responsible for the willful wrongs of the supervisor.
The issue is not whether there were thefts, but whether the hospital did something wrong in connection with the thefts. A possible defense would be that the hospital could not at the time identify the employee and there was no reasonable action they could take to catch the thief: that is, was their response "we don't care", or was it "we are incapable of using the evidence to catch the thief"? They might have been negligent in failing to investigate (e.g. they didn't even bother to ask staff "Who is this?"). Basically, what matters most is the specific facts.
On the other hand, suppose an employee steals yogurt from the cafeteria. Theoretically, customers were harmed because operational costs were increased and passed on to the customer, but this is such a stretch that there is no realistic chance of such a suit surviving a motion to dismiss.
There is also a chance that the contract has a disclaimer of liability, for example "the hospital will not be liable for theft of patient goods", so if one has received a copy of the contract then one can search for any such statements. This could narrow the circumstances under which a lawsuit could succeed. Even with an "enter at own risk" clause, it could still succeed if the facility were grossly negligent.