Rippling used a fake Slack clue to investigate an alleged leak to Deel

Rippling suspected someone inside the company was passing information to Deel, a rival. Its response was to create a clue that only a small group outside Rippling should know about—and watch for an employee looking for it.

Both companies sell businesses tools and services for managing employees, including payroll. They compete for customers. Internal information about buyers, sales discussions and unhappy accounts could give a rival an advantage before a sales call even began.

In March 2025, Rippling sued Deel, alleging that it had recruited an existing Rippling employee to obtain confidential information. The filings describe how Rippling tested its suspicion. They do not amount to a final verdict against Deel.

What did Rippling say the employee was doing?

Rippling’s March 17 complaint named Keith O’Brien and alleged that he accessed confidential sales, customer and competitive material for Deel’s benefit.

The allegation was that an employee already working at Rippling had been recruited. It was not that Deel had placed him in the job from the beginning.

Information about a buyer’s private concerns is different from the public pricing and product details available to anyone. That distinction explains why the alleged access mattered commercially, without assuming the allegations have all been proved.

How did the Slack trap work?

Rippling says it created a channel named d-defectors and mentioned it in a letter sent to a small group associated with Deel. The restricted channel name was the bait.

According to the complaint, O’Brien searched for it inside Rippling’s Slack workspace within hours. Rippling presented that sequence as evidence connecting the people receiving the external letter to an employee’s activity inside the company.

Rippling’s account of the test, illustrated from its complaint. This is not a Slack screenshot.

The logic is understandable: give selected people a distinctive clue, then look for someone acting on it elsewhere. Whether the evidence proves the larger allegations is a separate question for the proceedings.

Why did a lawyer ask for his phone?

Rippling obtained an Irish court order to preserve relevant evidence. An independent solicitor attended its Dublin office on March 14 to carry out that process.

The filings describe O’Brien refusing to hand over his phone and locking himself in a bathroom. Reports of a flushing sound became an especially memorable part of the story.

But “he flushed the phone” is not an established fact. In his April 1 sworn affidavit, O’Brien described pretending to flush it. The noise and the fate of the device should not be treated as the same thing.

What did O’Brien and Deel say?

O’Brien’s affidavit described providing information to contacts linked to Deel. A sworn account is evidence readers can examine; it does not automatically establish every allegation against the other defendants.

Deel denied wrongdoing. In its public account of its own lawsuit, it accused Rippling of improperly obtaining Deel information, including through a fake company account. Those are counter-allegations, not an answer supplied by the court.

What happened to O’Brien?

A March 2026 Irish judgment records that the issues between Rippling and O’Brien were resolved by March 27, 2025. It also set aside the later addition of individual Deel defendants to those Irish proceedings, because the underlying dispute with O’Brien had already been resolved.

That was a separate procedural outcome. It did not decide the US case against Deel.

Has either company won the US case?

The material reviewed does not establish a final decision on the central espionage allegations. A February 23, 2026 order allowed substantial claims to proceed while dismissing some state-law claims. A May discovery order concerned evidence gathering.

The result, as verified in the September 9, 2026 research check, is an unresolved US dispute—not a court-confirmed story of Deel’s guilt. The case needs another status check when scheduled for publication.

It is a compelling corporate-espionage story. It does not yet show a documented marketing campaign, a change in positioning or a measured effect on customer acquisition. Information useful to sales is part of the alleged motive; that alone does not make the episode a history of B2B marketing.