- HR software company Rippling is suing rival Deel, alleging it used a spy to steal company secrets.
- The lawsuit says Rippling caught the spy through a honeypot email to Deel’s top leaders.
- The alleged spy locked himself in a bathroom when approached with a court order, the lawsuit says.
The executives at Rippling had a problem.
Private information from the company kept leaking, the company said in a lawsuit filed Monday.
Recruiters at one of its chief rivals, Deel, had contacted more than a dozen Rippling employees on their personal phone numbers, which were unlisted, the lawsuit said.
Then a journalist approached Rippling, a workforce management software company, with a story claiming it may have violated sanctions, citing messages from Rippling’s Slack channels, according to the lawsuit.
After launching an investigation, Rippling found an employee in Ireland they now say was a spy digging for corporate secrets to pass off to the company’s competition.
The employee, who oversaw payroll issues in Europe, was looking at Slack channels with “no connection to his payroll operations job responsibilities” and searching for the term “Deel” more than a dozen times per day, according to a lawsuit, filed against Deel in San Francisco federal court.
The man — who is not named in the lawsuit — found sensitive information about potential customers who were looking to switch from Deel to Rippling, the lawsuit says. He downloaded a 31-slide deck that explained Rippling’s strategy for competing with Deel, the lawsuit alleges.
Rippling’s leadership believed they found their mole. So they set up a honeypot operation.
Believing that Deel “was most likely to activate its spy if faced with potentially damaging press,” Rippling’s general counsel emailed a legal letter to three of Deel’s top leaders. The letter identified a Slack channel called “#d-defectors,” where Rippling employees discussed information that Deel would find embarrassing if made public.
In reality, the “#d-defectors” channel did not exist until shortly before Rippling sent the letter to Deel, the lawsuit says.
“Rather than being a gathering place for ex-Deel employees, the channel was set up as part of a ruse designed to confirm that Deel was instructing D.S. to search for specific information in Rippling’s Slack,” Rippling’s lawsuit says, referring to the alleged “Deel’s spy.”
Deel “took the bait,” the lawsuit says. Just hours after Rippling sent the letter, the spy searched for and accessed the channel, the lawsuit alleges.
It was a “smoking gun” that Deel’s highest echelon — or someone working on its behalf — fed information to the alleged spy, Rippling said in the lawsuit.
Over the course of four months, the alleged spy pulled information from Rippling’s Slack, shared Google Drive, Salesforce database, and internal human resources directory, the lawsuit says.
A representative for Deel denied “all legal wrongdoing” and said Rippling was trying to distract from claims that it violated sanctions laws, which Rippling denies.
“Weeks after Rippling is accused of violating sanctions law in Russia and seeding falsehoods about Deel, Rippling is trying to shift the narrative with these sensationalized claims,” a Deel spokeswoman said in a statement. “We deny all legal wrongdoing and look forward to asserting our counterclaims.”
A tech rivalry for the ages
Rippling’s lawsuit, which demands a jury trial, marks a fiery escalation in its rivalry with Deel.
Founded in 2016 by Parker Conrad, a mainstay of the workforce software market, Rippling creates tools to streamline a company’s back office. It launched with the idea of gathering all of a customer’s data about its employees and placing it in one system.
Deel came onto the scene with a different proposition. In 2019, the company functioned as an “employer of record” for companies, allowing its customers to hire globally without having to worry about compliance regulations in different countries. Over time, Deel, led by founder Alex Bouaziz, bolted a wider range of products onto its system, building them in-house and buying up small players in payroll and IT.
The two firms now go head-to-head in the workforce software market, raising bigger and faster rounds of funding to expand their operations.
Their competition has often unfolded in the public eye. Last spring, when Rippling held a tender offer, which refers to the sale of a shareholder’s stock in a company, the company barred former employees who work for its competitors, including Deel, from cashing out.
In January, a class action complaint alleged Deel processed payments without the proper licenses related to a Ponzi scheme. The plaintiff’s lawyer, Thomas Grady, has been reported to be an investor in Rippling. In a motion to dismiss, Deel denied any wrongdoing and chalked up the complaint as a feckless attack by its biggest competitor.
A court order and a flushing toilet
Rippling said it picked up the alleged corporate spy’s trail partly by looking at his Slack activity. The employee, who joined Rippling in 2023, had rarely used the “preview” function on Slack, which allows users to view a channel’s contents without notifying colleagues, the lawsuit says.
In November 2024, the lawsuit says, the employee started previewing dozens of channels a month, sometimes peeking at particular channels more than 100 times each month.
The channels were dedicated to information about Rippling’s services and software sales, as well as information about competitors like Deel, the lawsuit says.
Rippling’s lawsuit alleges the employee’s browser and email history indicate he may have also met with Deel CEO Alex Bouaziz and Global Head of Expasion Olivier Elbaz in December.
On Wednesday, after the honeypot operation, Rippling sought a court order in Ireland to seize and inspect the alleged spy’s phone.
When a court-appointed solicitor served the employee with the order at Rippling’s Dublin office, the employee said his phone was in a bag on another floor.
It was a lie, the lawsuit alleged.
“The bag only contained a notebook. It held no mobile device,” the lawsuit says.
The spy then went to the bathroom and locked the door, “despite the independent solicitor’s repeated warnings that these actions were in violation of the court order,” the lawsuit says.
“I’m willing to take that risk,” the employee said, according to the lawsuit.
The employee “then stormed out of the office and fled the scene,” the lawsuit says.
Rippling says in the lawsuit the solicitor heard the employee flush the toilet, suggesting he “may have attempted to flush his phone down the toilet rather than provide it for inspection,” though a later inspection of the building’s plumbing “did not locate any mobile devices.”
Have a tip? Contact the reporters via email at mrussell@businessinsider.com and jshamsian@businessinsider.com or Signal at @meliarussell.01 or @JacobShamsian.07. Use a personal email address and a nonwork device; here’s our guide to sharing information securely.
