An HR company says it used a Slack trap to catch a corporate spy

• The HR software company Rippling is suing Deel, alleging it used a spy to steal company secrets.
• The lawsuit says Rippling caught the spy through a honeypot email to Deel's top leaders.
• It alleges the man locked himself in a bathroom when approached with a court order.

The executives at Rippling had a problem.

Private information from the company kept leaking, the company says in a lawsuit filed Monday.

The suit says recruiters at one of its chief rivals, Deel, had contacted more than a dozen Rippling employees using their unlisted personal phone numbers.

Then, it adds, a journalist approached Rippling, a workforce management software company, with a story claiming it may have violated sanctions, citing messages from Rippling's Slack channels.

After launching an investigation, Rippling says, the company found an employee in Ireland it now says was a spy digging for corporate secrets to pass off to the company's competition.

The lawsuit, filed against Deel in San Francisco federal court, says the employee, who oversaw payroll issues in Europe, was looking at Slack channels with "no connection to his payroll operations job responsibilities" and searching for the term "Deel" more than a dozen times a day.

The suit says the man — who is not named in the lawsuit — found sensitive information about prospective customers who were looking to switch from Deel to Rippling. It adds that he downloaded a 31-slide deck that explained Rippling's strategy for competing with Deel.

Rippling's leaders believed they found their mole. So they set up a honeypot operation, the company says.

Believing that Deel "was most likely to activate its spy if faced with potentially damaging press," Rippling's general counsel emailed a legal letter to three of Deel's top leaders, the lawsuit says. The letter identified a Slack channel called "#d-defectors," on which Rippling employees discussed information that Deel would find embarrassing if it was made public, it adds.

In reality, the lawsuit says, the #d-defectors channel did not exist until shortly before Rippling sent the letter to Deel.

"Rather than being a gathering place for ex-Deel employees, the channel was set up as part of a ruse designed to confirm that Deel was instructing D.S. to search for specific information in Rippling's Slack," Rippling's lawsuit says, referring to the person it says was "Deel's spy."

Deel "took the bait," the suit says. Just hours after Rippling sent the letter, it adds, this person searched for and accessed the channel.

It was a "smoking gun," Rippling says in the lawsuit, that Deel's highest echelon — or someone working on its behalf — fed information to that person.

Over the course of four months, the lawsuit says, the man pulled information from Rippling's Slack, shared Google Drive, Salesforce database, and internal human resources directory.

A representative for Deel denied "all legal wrongdoing" and said Rippling was trying to distract from claims that it violated sanctions laws, which Rippling denies.

"Weeks after Rippling is accused of violating sanctions law in Russia and seeding falsehoods about Deel, Rippling is trying to shift the narrative with these sensationalized claims," a Deel spokesperson said in a statement. "We deny all legal wrongdoing and look forward to asserting our counterclaims."

A tech rivalry for the ages

Rippling's lawsuit, which demands a jury trial, marks a fiery escalation in its rivalry with Deel.

Founded in 2016 by Parker Conrad, a mainstay of the workforce software market, Rippling creates tools to streamline a company's back office. It launched with the idea of gathering all of a customer's data about its employees and placing it in one system.

Deel came onto the scene with a different proposition. In 2019, the company functioned as an "employer of record" for companies, allowing its customers to hire globally without having to worry about compliance regulations in different countries. Over time, Deel, led by its cofounder and CEO, Alex Bouaziz, bolted a wider variety of products onto its system, building them in-house and buying up small players in payroll and IT.

The two firms now go head-to-head in the workforce software market, raising bigger and faster rounds of funding to expand their operations.

Their competition has often unfolded in the public eye. This past spring, when Rippling held a tender offer, which refers to the sale of a shareholder's stock in a company, the company barred former employees who work for its competitors, including Deel, from cashing out.

In January, a class action complaint alleged that Deel lacked the proper licenses to process payments for a company accused of operating a Ponzi scheme but that it did so anyway.

The plaintiff's lawyer, Thomas Grady, has been reported to be an investor in Rippling. In a motion to dismiss, Deel denied any wrongdoing and rejected the complaint as a feckless attack by its biggest competitor.

A court order and a flushing toilet

Rippling says it picked up the trail of the person it alleges was a corporate spy partly by looking at his Slack activity. The employee, who joined Rippling in 2023, had rarely used the "preview" function on Slack, which allows users to view a channel's contents without notifying colleagues, the lawsuit says.

In November, the suit says, the employee started previewing dozens of channels a month, sometimes peeking at particular channels more than 100 times each month.

The channels were dedicated to information about Rippling's services and software sales, as well as information about competitors like Deel, the lawsuit adds.

Rippling's suit says the employee's browser and email history indicate he may have also met with Bouaziz and Deel's global head of expansion, Olivier Elbaz, in December.

On Wednesday, after the honeypot operation, Rippling sought a court order in Ireland to seize and inspect the employee's phone.

When a court-appointed solicitor served the employee with the order at Rippling's Dublin office, the suit says, the employee said his phone was in a bag on another floor.

It was a lie, the lawsuit alleges.

"The bag only contained a notebook. It held no mobile device," the lawsuit says.

The suit says the man then went to the bathroom and locked the door, "despite the independent solicitor's repeated warnings that these actions were in violation of the court order."

"I'm willing to take that risk," the employee said, the lawsuit adds.

The employee "then stormed out of the office and fled the scene," the lawsuit says.

Rippling says in the lawsuit the solicitor heard the employee flush the toilet, suggesting he "may have attempted to flush his phone down the toilet rather than provide it for inspection," though a later inspection of the building's plumbing "did not locate any mobile devices."

Have a tip? Contact the reporters via email at mrussell@businessinsider.com and jshamsian@businessinsider.com or Signal at @meliarussell.01 or @JacobShamsian.07. Use a personal email address and a nonwork device; here's our guide to sharing information securely.