The Deel-Rippling spy lawsuit just became a federal case

On March 17, 2025, Rippling sued Deel, alleging that a Deel-recruited insider had spent months quietly funneling confidential Slack messages, sales pipelines, and product roadmaps out of Rippling. Rippling’s own announcement framed it as long-running “corporate espionage” by a $12 billion rival. What makes the case unusually well-documented, for a B2B software dispute, is how it was caught: Rippling’s lawyers seeded a fake Slack channel called “d-defectors” as a honeytrap, then watched to see who went looking for it.

That someone was Keith O’Brien, a Rippling employee in Dublin. His April 1, 2025 affidavit — reported in detail by TechCrunch — describes roughly four months of searching Slack and Google Drive on Deel’s behalf in exchange for a €5,000 monthly retainer, paid first in dollars and later in crypto. When confronted by a lawyer on March 14, 2025, O’Brien admitted he panicked and destroyed evidence, testifying that he “wiped my old phone with an axe and put it down the drain at my mother-in-law’s house.”

The case has not gone cleanly in Rippling’s favor. On August 20, 2025, a court dismissed Rippling’s RICO and fraud claims, and Deel’s own recap leans hard on that ruling, quoting the court’s finding that Rippling’s RICO theory described “a unified corporate structure, not a distinct RICO enterprise” and calling the underlying suit “frivolous.” Deel maintains it “operates with integrity and full compliance with the law.” Note the remaining trade-secret claims were not dismissed — only the RICO and fraud counts.

Then, on November 20, 2025, newly unsealed banking records complicated Deel’s framing. Calcalist reported that O’Brien’s initial $6,000 payment was routed from a Deel corporate account through an account belonging to the wife of Deel’s COO — landing in O’Brien’s account 56 seconds later. Rippling’s lawyers are now asking, per the report, “what Deel disclosed to its external financial auditors and to its newly appointed senior executives” about how those payments were categorized. Deel, for its part, has countersued alleging Rippling ran its own infiltration scheme, and argues O’Brien is a compromised witness receiving “a €110,700 lump sum, blank check for his expenses, and legal indemnification” for his cooperation.

The most consequential update is the most recent: the Wall Street Journal reported on January 23, 2026 that the Justice Department has opened a criminal probe into the spy allegations — moving what began as a civil dispute between two vendors into federal criminal territory. As of today, that probe and the underlying trade-secret claims are still active; nothing here has been through trial.

What it means for HR/payroll buyers

Neither company’s core payroll and compliance product has been found to be defective, and none of this has been resolved by a court — treat “who’s right” as unsettled. But if you’re running procurement on Deel, Rippling, or any HR-tech vendor right now, an active federal criminal probe into a competitor relationship is exactly the kind of fact worth surfacing in a vendor risk review, alongside the usual security and compliance checklist. See how Deel stacks up against a third option on Crail’s Gusto vs Deel comparison, and browse the full HR & Payroll category for more vendors in the space.