March 2025: The Honey Pot Scandal – Rippling v. Deel Lawsuit

Deel Unicorn dipping into the Rippling Honey Pot Only one story on the minds of TA Tech folks this week, the Rippling v. Deel lawsuit. The continued feud now includes corporate espionage, secret Slacks and a honey trap —— no, no a honey pot, which I learned this week is a WAY different thing.

No time like the present, let’s dive in!

A History of Bad Blood & the tale of a master spy

So here is the gist, there is lots of bad blood between Deel and Rippling. I don’t think this is a secret to much of anyone.

The complaint filed this week in federal court alleges:

Rippling had unknowingly hired a person (the “Spy”) who allegedly gathered data and shared it with Deel. The Spy viewed and downloaded information on how to go up against Deel in competitive sales situations. He also had information on sales calls, demos and support requests.

The complaint lays out in great detail the case against Deel and the Spy.

Logs show systematic (and suspicious) data searches on Slack.
Honey pot test confirms Deel’s involvement.
Spy’s search behavior targeted sensitive competitive data.
Evidence Deel used stolen contact info to poach employees.
Deal losses correlated with stolen intelligence.
Suspicious search terms match a media investigation.

The complaint, which I uploaded here, is fifty pages of JUICY details. We will dig in after the following PSA (Public Service Announcement).

But First a Lesson:

Honey Pot (in geek speak) is VERY DIFFERENT from Honey Trap – although they are both often used on geeks.

Keep_Mum_-_She's_Not_so_Dumb!

Honey Pot

Context: Mostly used in cybersecurity and military intelligence.
Definition: A honey pot is a decoy system or resource designed to lure attackers (or spies) away from real targets.
Purpose: To detect, deflect, or study unauthorized access attempts and gather intelligence.
Example: A fake server, or in this case Slack channel, with no real data that looks vulnerable to attackers, so one can monitor their actions.

Honey Trap

Context: Primarily used in espionage or social manipulation.
Definition: A honey trap involves using romantic or sexual relationships to manipulate, blackmail, or extract information from a target.
Purpose: To exploit personal vulnerabilities.
Example: An undercover agent seducing a person to gain access to sensitive information.

Honey pot = cyber/technical bait.

Honey trap = emotional/romantic bait.

For this master spy story, there is no honey trap….just a honey pot.

Now back to our regularly scheduled programming – The complaint.

So I dug in to this very long and very complex complaint and pulled out for you, my friends, some of the juiciest juice. In full transparency, I did use ChatGPT to help me out but with all appropriate QA/QC as to not lead any of you astray.

As you dive in, a couple of notes – I did not add any emphasis below as to not skew the intent of the complaint and “D.S.” is referring to the alleged Spy, who I am going to leave unnamed because it seems more fun that way.

1. Digital Forensic Evidence from Slack Logs

📌 Complaint Reference:

“Rippling’s Slack logs show that D.S. began searching and accessing Rippling’s Slack channels at an unprecedented rate beginning in or around early November 2024. Notably, D.S. searched the term “deel” approximately 23 times per day.” (Page 17)

“To illustrate a few examples of the Sales and Marketing Trade Secrets and confidential information within Rippling’s Slack channels, D.S. viewed the following slack channels:” (Pages 21-22)

#mops-inbound-request-alerts (every inbound sales request logged).
#deal-desk-sales (customer names, sales quotes, pricing details).
#mm-global-high-intent-notifications (list of new customers booking demos).
#PEO-Dealroom (ongoing pricing negotiations).

2. Evidence from “Honeypot” Test

📌 Complaint Reference:

“Rippling’s General Counsel sent a legal letter to Deel’s senior leadership identifying a recently established Slack channel called ‘d-defectors,’ in which (the letter implied) Rippling employees were discussing information that Deel would find embarrassing if made public.” (Page 4)

“Yet, just hours after Rippling sent the letter to Deel’s executives and counsel, Deel’s spy searched for and accessed the #d-defectors channel—proving beyond any doubt that Deel’s top leadership, or someone acting on their behalf, had fed the information on the #d-defectors channel to Deel’s spy inside Rippling.” (Page 5)

3. Surveillance of the Spy’s Search Behavior

📌 Complaint Reference:

“The channels D.S. previewed during this period have no connection to his payroll operations job responsibilities. What they do relate to, however, are all aspects of Rippling’s business development, sales, and customer retention strategies—the most sensitive of the Company’s Sales and Marketing Trade Secrets and confidential business information—with a particular emphasis on a single competitor, Deel.” (Page 20)

“D.S. viewed channels related specifically to Rippling’s competitive intelligence concerning Deel over 450 times during the course of the scheme.” (Page 20)

4. Evidence of Deel’s Employee Poaching Using Stolen Data

📌 Complaint Reference:

“Between January 29 and February 17, 2025, at least seventeen (17) members of Rippling’s Global Payroll Operations Team were contacted about similar jobs at Deel and at least ten reported receiving offers from Deel.” (Page 26)

“Some of these team members were contacted directly via WhatsApp, a messaging application that requires knowledge of a person’s mobile phone number to send a message.” (Page 26)

“On January 27, 2025, D.S. visited this individual’s page in Rippling’s internal personnel directory, which contains employees’ personal phone numbers. Later that same day, Mr. Westgarth messaged the team member on WhatsApp.” (Page 27)

5. Evidence of Tampering and Destruction of Evidence

📌 Complaint Reference:

“Last Friday (March 14, 2025), at Rippling’s offices in Dublin, a court-appointed independent solicitor served Deel’s spy with the court order to preserve his mobile phone.(Page 6)

“Faced with a choice between providing his cell phone for examination pursuant to a lawful court order or going to jail for not complying, the spy chose the latter. The spy responded: ‘I’m willing to take that risk.’ He then fled the premises.” (Page 6)

6. Direct Competitive Damage Evidence

📌 Complaint Reference:

“On March 11, 2025, a new Slack channel was created to discuss a company (“Prospect A”) that was already using Rippling for certain products but was not using Ripping’s HRIS product. A single message was posted, noting that this Prospect A was ‘exploring options to transition their 90+ international employees from Deel/Personio to a new HRIS platform and are evaluating Rippling.’” (Page 23)

“By the very next day, March 12, 2025, D.S. had found and previewed this channel three times, guided by his cornerstone search term, ‘deel’.” (Page 23)

“Later that day, Prospect B abruptly canceled the scheduled call with Rippling in which Rippling was going to deliver its proposal—and explained that they were doing so because they had decided to select Deel.” (Page 24)

7. Correlation Between Spy’s Search Activity & Deel’s Actions

📌 Complaint Reference:

“D.S. first searched the term ‘Russia’ on February 12, 2025. From that date until February 27, 2025, D.S. searched the term ‘Russia’ 157 times, an average of almost 9 times per day.” (Page 28)

“D.S. first searched the term ‘OFAC’ (i.e., U.S. Office of Foreign Assets Control, a regulator responsible for sanctions controls) on February 17, 2025. From that date until February 27, 2025, D.S. searched the term ‘OFAC’ 42 times, an average of over 5 times per day.” (Page 28)

“These assertions did not hold water—to be clear, Rippling has never transmitted a payment to a sanctioned country, individual, entity or bank, including Russia—but the fact that internal Rippling Slack messages (which are only available to Rippling employees) were in the possession of someone other than a Rippling employee caused Rippling to immediately open a security investigation.” (Page 28)

Whew, that is a lot and it is clearly just beginning.

My takeaway, if I am an investor or prospective post IPO shareholder, this type of (alleged) immature behavior and the ongoing controversies around Deel do not give me the warm and throw all my money in fuzzies. Right or wrong, the news cycle needs to get handled, ASAP.