Rippling vs. Deel - Inside the Corporate Espionage Rocking Silicon Valley
Thoughts on what it means to operate in a highly competitive space
TL;DR
On March 17, 2025: Rippling, a global HR software company, sued another HR giant, Deel, alleging corporate espionage, claiming Deel planted a mole inside Rippling to steal trade secrets.
The evidence so far leans toward Rippling catching the mole, AKA ‘Deel Spy’ (D.S.), through a "honeypot" trap on Slack, with D.S. accessing a fake channel, confirming Deel's involvement. Read more on this below.
This case highlights the importance of data security for startups, with tactics like monitoring Slack logs and legal action being key.
It’s an important lesson for startup founders to protect trade secrets, vet employees, and even prepare for legal battles, given the competitive tech landscape.
An unexpected tidbit is the dramatic moment when D.S. locked himself in a bathroom to destroy evidence, adding a human element to the corporate dispute.
A lot has happened recently around this, and while events are still evolving, I thought I would provide a bit more clarity on what’s been happening. But also, why I think ALL founders should study this particular case, because it clearly shows deep lessons on what it means to operate in such a competitive space.
You can read the full court filing here:
The Timeline (so far)
Rippling (valued at $13.5B), a San Francisco-based HR software startup, filed a lawsuit against Deel (valued at over $12B), another HR tech giant, on March 17, 2025, accusing them of corporate espionage.
The complaint basically alleges that Deel cultivated a mole, referred to as D.S. (later identified as O’Brien), within Rippling’s Dublin office to steal sensitive trade secrets, including sales leads, customer lists, and competitive strategies.
This case has been getting plenty of attention due to its spy-thriller-like elements and the high stakes in the competitive HR tech market.
From what I was able to find and gather (so far), here’s a detailed timeline of events from the beginning, based on court filings and reports:
November 16, 2022: Rippling informs Deel it will not renew Deel’s contract due to competitive concerns. Deel was still quite early at this point, and they were using Rippling as their HR platform while quietly building out their own similar HR service in the background. That’s until Rippling found out. June 20, 2023: Rippling hires D.S. (the Deel mole) as Global Payroll Compliance Manager in Dublin.Over Next 18 months: D.S. conducts over 6,000 suspicious searches, averaging 23 searches for “Deel” per day, accessing sales pipelines, pricing, customer data, and Slack channels.December 9, 2024: D.S. meets with Deel executives, including CEO Alex Bouaziz, confirmed by email records.January 29–Feb 17, 2025: Deel contacts 17 Rippling employees for jobs, some directly on WhatsApp, after D.S. accessed contacts.Feb 18, 2025: The Information contacts Rippling about Russian sanctions, also revealing leaked Slack messages. These leaked messages indicate that they were released by the D.S., to create bad PR for Rippling. But it also created a red-alert from inside Rippling to investigate further on this leak.March 3, 2025: Rippling then set up a "honeypot" to catch the mole. They send a letter to Deel’s leadership mentioning fake “#d-defectors” Slack channel.March 3–4, 2025: D.S. accesses fake channel 5 times, confirming Deel’s involvement and direction to the D.S. to collect information about said channel. March 12, 2025: Rippling obtains Irish High Court order to preserve D.S.’s phone data.March 14, 2025: D.S. served with order, locks himself in bathroom, attempts to destroy evidence, and flees.March 17, 2025: Rippling files lawsuit against Deel in U.S. District Court, Northern District of California.As you can see, this timeline shows a deliberate and escalating pattern of alleged espionage, culminating in legal action taken by Rippling.
The Tactics to Catch Deel Redhanded
It turns out that Rippling used several interesting tactics to uncover and document Deel’s alleged espionage, showing a proactive approach to protecting its assets:
Internal Investigation: Rippling analyzed thousands of Slack logs, identifying D.S.’s suspicious activity, including over 6,000 queries, with “deel” searches averaging 23 times a day. This included:
Over 1,300 previews of channels related to sales prospects.
Over 600 previews of channels related to existing customers.
Over 100 previews of channels related to churn risks. This activity was logged due to Rippling’s policy of monitoring Slack usage, a critical security measure.
Forensic Analysis: When The Information revealed leaked Slack messages, Rippling traced the source to D.S. using IP addresses and search logs, linking his actions to Deel through email records of meetings with Deel executives. They identified that D.S. had accessed sensitive data, including sales pipelines, customer profiles, and pricing strategies.
Honeypot Operation: To confirm Deel’s involvement, Rippling created a fake Slack channel, “#d-defectors,” and mentioned it in a legal letter sent to Deel’s top executives, including Philippe Bouaziz (Chairman and CFO) and Spiros Komis (Head of US Legal). Within hours, D.S. searched for and accessed the channel, providing definitive evidence that Deel’s senior leadership was directing his actions. This tactic is a classic counter-espionage move, leveraging deception to catch the spy.
Legal Action: Rippling obtained an Irish High Court order to preserve D.S.’s phone data, served by an independent solicitor. D.S.’s attempt to destroy evidence by locking himself in a bathroom and fleeing further strengthened Rippling’s case.
Employee Agreements and Security: Rippling required confidentiality agreements and restricted system access with authentication protocols, logging all Slack activity to detect anomalies.
These tactics clearly showed Rippling’s readiness and proactivness to use both technological and legal tools to protect its interests.
When everything was official and confirmed that Parker Conrad, the CEO of Rippling, posted the announcement on X.
What’s at Stake
To give you an idea of what’s at stake here:
The global HR and recruitment services market was valued at approximately $893.9 billion in 2024, growing at a 2.9% increase compared to 2023, and is expected to continue growing.
As you can see, the global market size for HR&R is HUGE! This means that there is a strong incentive for companies like Deel, Rippling and many others to take as many slices of the pie as possible.
But Deel and Rippling have some of the biggest combined market share, and their history of rivalry means that there is a lot at stake if one of them caves.
The images below show the services both competitors offer. You can see they are eerily similar, with a few exceptions like IT by Rippling, which in this case is their attempt to differentiate themselves even more so from others.
Ultimately, it goes to show that there is a massive gain (and also loss) in this market if anyone slips up.
Why Startup Founders Should Care
This case is a wake-up call for startup founders, especially in competitive sectors like HR tech (and many others). Corporate espionage can significantly undermine a startup’s competitive advantage, erode customer trust, and damage reputation/goodwill.
Here are a few key reasons why this matters:
Trade secrets are BIG TARGETS: Startups often rely on proprietary information like sales strategies, customer lists, and pricing models, making them prime targets for competitors. Rippling’s allegations show how such data can be weaponized to gain an unfair advantage.
Insider threats are REAL: The case of D.S. illustrates that employees can be unwitting or willing participants in espionage. Founders must be aware that competitors might plant moles, as alleged here, and should even take steps to vet hires carefully.
LEGAL PROTECTIONS are Essential: Rippling took advantage of RICO and trade secret laws, ensuring the importance of having strong legal protections in place. Founders should ensure confidentiality agreements are robust and be prepared to take legal action if necessary.
Competitive pressure can lead to FOUL PLAY: The history of tension between Rippling and Deel, including marketing campaigns like the “Snake Game,” shows how competition can escalate. Founders must monitor rivals’ actions and be ready for potential foul play.
REPUTATION and valuation risks: A breach can damage a startup’s reputation and erode customer trust, which is particularly damaging for early-stage companies where perception drives valuation. This case highlights the need for proactive reputation management.
Guidance and Lessons for Startups
To protect against corporate espionage, startups should adopt the following best practices:
Conduct thorough background checks: Verify the integrity of new hires, especially in sensitive roles, to ensure no ties to competitors.
Implement robust data security: Use tools to log and monitor employee activity on platforms like Slack, as Rippling did. Restrict access to sensitive data based on job functions, and enforce strong authentication protocols like multi-factor authentication.
Set up early warning systems: Consider honeypot traps or decoy systems to detect unauthorized access, as Rippling did with the fake Slack channel. You can also regularly audit access logs for unusual patterns, such as frequent searches for competitor names or unrelated data.
Protect trade secrets legally: Require all employees to sign confidentiality agreements. Clearly define what constitutes a trade secret and enforce non-disclosure policies through training and reminders.
Stay vigilant against competitors: Monitor public statements and actions from rivals, such as marketing campaigns or job poaching, and be prepared for legal battles by having a solid legal team in place. Rippling’s proactive legal action, including obtaining an Irish High Court order, shows the importance of international legal preparedness.
Foster a culture of trust and transparency: Encourage employees to report suspicious activity, such as unusual searches or contacts from competitors. Provide regular training on the importance of protecting company data and the consequences of misuse, creating a culture where security is everyone’s responsibility.
These lessons can help startups safeguard their most valuable assets in a competitive landscape.
Conclusion
The Rippling vs. Deel lawsuit is a stark reminder of the risks of corporate espionage in the startup world. It highlights the importance of protecting trade secrets, vetting employees, and being prepared for legal battles in a competitive landscape.
And yes, by learning from Rippling’s tactics—such as monitoring Slack logs, using honeypot traps, and taking swift legal action—founders can safeguard their companies against similar threats.
But, the case also underscores the need for vigilance, legal preparedness, and fostering a culture of trust, ensuring startups can compete fairly without falling victim to foul play.
It’s pretty crazy to see what can happen when competitive pressures mount - rational thinking goes out the window, winning-at-all-costs becomes the norm, echo chambers start to form, and groupthink takes over.
As this drama unfolds, it serves as a cautionary tale and a guide for navigating the high-stakes world of startup competitiveness.
Connect with Me
Are you new to the newsletter? Subscribe Here
Learn more about me on my website
Check out my YouTube channel (and subscribe!)
If you’re a founder, apply here (Metagrove Ventures) for startup funding or contact me directly at barry@metagrove.vc
Thanks for reading.
If you like the content, feel free to share, comment, like, and subscribe.
Barry.