---
title: "Rippling insider espionage allegations and litigation"
description: "Rippling’s March 2025 insider espionage allegations, decoy-channel account and Deel’s denial, with disputed claims preserved."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-10-07"
canonical_url: "https://www.ally.security/incidents/rippling-insider-espionage-allegations-2025"
markdown_url: "https://www.ally.security/incidents/rippling-insider-espionage-allegations-2025.md"
stix_url: "https://www.ally.security/incidents/rippling-insider-espionage-allegations-2025/stix.json"
---

# Rippling insider espionage allegations and litigation

Rippling alleged theft of internal commercial information by an employee acting for Deel. Deel denies the allegations.

Last modified Oct 7, 2026 · 2 sources

## Summary

- **Environment:** Internal collaboration and commercial information
- **Operational impact:** Alleged commercial-information theft; claims disputed
- **Financial impact:** No adjudicated damages established in this record

## What happened

On March 17, 2025, [Rippling](https://www.rippling.com/) [announced litigation](https://www.rippling.com/blog/lawsuit-alleges-12-billion-unicorn-deel-cultivated-spy-orchestrated-long-running-trade-secret-theft-corporate-espionage-against-competitor) alleging that an employee passed confidential information to [Deel](https://www.deel.com/). Deel [denies the allegations](https://www.deel.com/blog/deel-files-lawsuit/). These are competing party accounts, not a determination of liability. [1](#source-1) [2](#source-2)

## Impact

- Rippling alleges that sales-pipeline and customer-interaction information was taken. That claim remains disputed here. [2](#source-2)
- This record establishes neither an affected-person count nor adjudicated damages.

## Timeline

### March 17, 2025 — Lawsuit announced

Rippling publicly described the allegations in its [announcement](https://www.rippling.com/blog/lawsuit-alleges-12-billion-unicorn-deel-cultivated-spy-orchestrated-long-running-trade-secret-theft-corporate-espionage-against-competitor). [2](#source-2)

### October 7, 2026 — Briefing updated

This briefing was last reviewed and updated on October 7, 2026.

## Threat Group & Attack Vector

Rippling describes misuse of employee Slack access. It says a decoy channel referenced in a letter to Deel leadership and counsel was subsequently searched by the employee. Both assertions are retained as allegations. [2](#source-2)

### Actors

- Alleged employee and competitor involvement is contested; no threat actor group is established. [1](#source-1) [2](#source-2)

### TTPs

- No specific MITRE ATT\&CK technique is mapped to these disputed allegations.

## Response

The dispute proceeded through litigation and opposing public statements. Deel’s [litigation page](https://www.deel.com/blog/deel-files-lawsuit/) presents its denial and counter-allegations. The retained evidence is not a complete docket history. [1](#source-1) [2](#source-2)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/rippling-insider-espionage-allegations-2025/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Deel’s Counterclaims Against Rippling

official · Deel

<https://www.deel.com/blog/deel-files-lawsuit/>

<a id="source-2"></a>

### Lawsuit Alleges $12 Billion Unicorn Deel Cultivated Spy, Orchestrated Long-Running Trade-Secret Theft and Corporate Espionage Against Competitor

official · Rippling · Mar 17, 2025

<https://www.rippling.com/blog/lawsuit-alleges-12-billion-unicorn-deel-cultivated-spy-orchestrated-long-running-trade-secret-theft-corporate-espionage-against-competitor>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Resulted In · 100% confidence · current**  
   Rippling insider espionage allegations and litigation: Rippling announces lawsuit against Deel
2. **Occurred At · 100% confidence · current**  
   Rippling announces lawsuit against Deel: 2025-03-17
3. **Resulted In · 70% confidence · disputed**  
   Rippling insider espionage allegations and litigation: Rippling alleges that confidential sales-pipeline and customer-interaction information was taken.
4. **Resulted In · 70% confidence · disputed**  
   Rippling insider espionage allegations and litigation: Rippling says a decoy Slack-channel reference sent to Deel leadership and counsel was followed by an employee search for that channel.
5. **Resulted In · 70% confidence · disputed**  
   Rippling insider espionage allegations and litigation: Rippling alleges an employee used internal Slack access to pass confidential commercial information to Deel.
6. **Resulted In · 100% confidence · current**  
   Rippling insider espionage allegations and litigation: Deel denies Rippling’s allegations and presents opposing allegations in its litigation statement.
7. **Affected Organization · 100% confidence · current**  
   Rippling insider espionage allegations and litigation: Rippling
8. **Disclosed At · 100% confidence · current**  
   Rippling insider espionage allegations and litigation: 2025-03-17

</details>