What happened
On March 17, 2025 Rippling sued rival HR and payroll company Deel in the Northern District of California, alleging Deel cultivated a Rippling employee as a spy. The complaint says the employee searched Rippling systems for 'Deel' an average of 23 times a day over four months and accessed Slack channels more than 6,000 times without business justification, funnelling sales pipeline data, pricing, customer churn lists and employee contact details to Deel. Deel denies wrongdoing and the litigation continues.
How the deception worked
The alleged access was entirely legitimate on its face. A person in a management role at a Rippling affiliate used their normal credentials to run searches and read Slack channels, activity that generated no security alerts because none of it was unauthorised in a technical sense; the abuse was in volume and purpose. Rippling exposed it with a honeypot rather than a detection rule: it sent a letter to three Deel executives referencing a Slack channel called 'd-defectors' that existed but had never contained a single message. Within hours the employee searched for that never-used channel for the first time, which Rippling argues shows the letter's contents were relayed to him. He was confronted when court-appointed solicitors sought his phone.
AI involvement · No AI reported
No AI involvement was alleged.
The control that would have caught it· our reading, not a claim from the sources
Insider risk programmes need behavioural baselining on internal search and channel access, since a recruited insider's activity is authorised by definition and only its pattern gives it away.
Sources (2)
- Lawsuit Alleges $12 Billion 'Unicorn' Deel Cultivated Spy, Orchestrated Long-Running Trade-Secret Theft & Corporate Espionage Against CompetitorRippling·rippling.comOpen ↗
- Rippling accuses competitor Deel of corporate espionageHR Brew·hr-brew.comOpen ↗
This entry summarises public reporting. It is not a legal finding, and details can change as investigations conclude. Found an error? Send a correction.