Incident BriefingsRippling insider espionage allegations and litigation

Rippling insider espionage allegations and litigation

Rippling alleged theft of internal commercial information by an employee acting for Deel. Deel denies the allegations.

Last modified

Summary

  • Environment: Internal collaboration and commercial information
  • Operational impact: Alleged commercial-information theft; claims disputed
  • Financial impact: No adjudicated damages established in this record
  • Record status: Developing record. Reviewed October 7, 2026; updated as evidence emerges.

What happened

On March 17, 2025, Rippling announced litigation alleging that an employee passed confidential information to Deel. Deel denies the allegations. These are competing party accounts, not a determination of liability. [1][2]

Impact

  • Rippling alleges that sales-pipeline and customer-interaction information was taken. That claim remains disputed here. [2]
  • This record establishes neither an affected-person count nor adjudicated damages.

Timeline

  1. Lawsuit announced

    Rippling publicly described the allegations in its announcement.

    [2]

  2. Briefing updated

    This briefing was last reviewed and updated on October 7, 2026.

Threat Group & Attack Vector

Rippling describes misuse of employee Slack access. It says a decoy channel referenced in a letter to Deel leadership and counsel was subsequently searched by the employee. Both assertions are retained as allegations. [2]

Actors

  • Alleged employee and competitor involvement is contested; no threat actor group is established. [1][2]

TTPs

  • No specific MITRE ATT&CK technique is mapped to these disputed allegations.

Response

The dispute proceeded through litigation and opposing public statements. Deel’s litigation page presents its denial and counter-allegations. The retained evidence is not a complete docket history. [1][2]