Rippling Lawsuit: Deel Espionage, RICO Complaint, DOJ Probe

The Rippling v. Deel lawsuit is a federal corporate espionage case filed in March 2025 in which HR platform Rippling accuses rival Deel of planting a paid mole inside its Dublin office to steal trade secrets, customer data, and competitive intelligence. The employee later confessed under oath in an Irish court, Rippling added a federal racketeering claim naming Deel’s CEO as the “chief architect” of the scheme, and the U.S. Department of Justice has opened a parallel criminal investigation. Deel denies the allegations and has filed counterclaims of its own.

What Rippling Says Deel Did

On March 17, 2025, People Center, Inc. — doing business as Rippling — filed a seven-count complaint against Deel, Inc. in the U.S. District Court for the Northern District of California under case number 3:25-cv-2576.¹ The original complaint brought claims for RICO violations, misappropriation of trade secrets, and unfair trade practices.²

According to Rippling, a Global Payroll Compliance Manager in its Dublin office, hired by a Rippling affiliate in 2023, systematically funneled confidential information to Deel’s leadership. He allegedly searched Rippling’s internal systems for the term “Deel” an average of 23 times per day over four months and ran more than 6,000 searches inside Rippling’s internal Slack, digging into channels unrelated to his job.³ The material allegedly stolen included sales pipeline data, proposed pricing, customer details, a competitive intelligence strategy deck, and a list of customers considered at risk of leaving Rippling.⁴

How Rippling Caught the Mole

Rippling’s security team identified the employee through a honeypot. After noticing the unusual search activity, the company created an empty, never-before-used Slack channel called “#d-defectors” and sent a letter referencing that channel to three specific people: Deel board chairman and CFO Philippe Bouaziz (father of CEO Alex Bouaziz), Deel’s head of U.S. legal Spiros Komis, and Deel’s outside counsel.³

Within hours, the suspected mole searched for that exact channel for the first time. Rippling treated this as proof that senior Deel figures or their lawyers were directing him, since only the three recipients knew the channel existed.³

When Rippling confronted the employee at its Dublin office on March 14, 2025, and served him with a court order to hand over his phone, he reportedly locked himself in a bathroom. A court-appointed solicitor warned him that destroying evidence could lead to jail. According to the lawsuit, he replied, “I’m willing to take that risk,” and left the building.³

The Confession

The employee, later identified as Keith O’Brien, entered a cooperation agreement with Rippling on March 25, 2025 and in April 2025 filed a sworn affidavit in Ireland’s High Court admitting he had acted as a paid informant for Deel.⁵⁶ He said Deel CEO Alex Bouaziz personally recruited him in September 2024, referenced James Bond during the pitch, and told him to stay at Rippling to gather intelligence.⁷ According to O’Brien, Bouaziz supplied specific search terms to use inside Rippling’s Slack, Salesforce, and Google Drive to pull out global payroll strategies, sales data, marketing plans, and customer details.

O’Brien testified he was paid roughly €5,000 a month. The first payment, $6,000 in November 2024, arrived by Revolut transfer from an account belonging to Alba Basha, the wife of Deel COO Dan Westgarth.⁸ After that, he said, Philippe Bouaziz instructed that payments switch to Ethereum sent to O’Brien’s Blockchain.com wallet to leave “no trace.”⁹ Payments were signaled through a Telegram group chat set to auto-delete after 24 hours: O’Brien would send a photo of a wristwatch, and Philippe Bouaziz would reply with phrases like “send that watch to London” and “the buyer is happy” to release funds.

O’Brien also described what he called a cover-up after the honeypot exposed him. He said Deel’s in-house lawyer Asif Malik instructed him to buy a burner phone, smash his existing phone with an axe, and dispose of it down a drain at his mother-in-law’s house, which he said he did on March 16, 2025.⁸ He said Deel’s lawyers also offered to relocate him and his family to Dubai and cover his legal costs.⁷ O’Brien further stated that Malik and Deel head of legal Andrea David Mieli instructed him to file a false report with the Central Bank of Ireland accusing Rippling of illegal “Russian payments” to “shift the narrative.” He said he filed the report knowing the claim was false.¹⁰

His 47-page exhibit submission included crypto transaction records, deleted-message notifications, and examples of documents he said he took from Rippling.⁵ Deel later admitted it had “instructed discreet surveillance” of O’Brien after initially denying his claim that he was being followed.¹¹

The Amended RICO Complaint

On June 5, 2025, Rippling filed an amended complaint that formally named Alex Bouaziz as the “chief architect” of what it called the “Bouaziz Racketeering Enterprise” and added a RICO charge, characterizing the defendants as a “criminal syndicate.”¹²

The amended filing alleged the operation reached beyond Rippling, naming nine additional targeted companies: Papaya, Velocity Global, Remote, G-P (Globalization Partners), Omnipresent, Oyster, Boundless, Payzaar, and Remofirst. O’Brien allegedly searched Rippling’s Slack for information about these competitors more than 300 times. The complaint also identified another alleged victim, Toku, which had sued LiquiFi in December 2024 over a scheme it said was intended to “crush Toku,” and described a startup accelerator from which two conspirators allegedly stole a full CRM database at Bouaziz’s direction. Rippling further alleged that Deel whistleblowers said new hires from competitor firms were celebrated at Deel company meetings for the trade secrets they brought with them.¹⁰

Deel’s Denials and Counterclaims

Deel denies the espionage allegations. A Deel spokeswoman said the company “looks forward to its day in Court where Rippling and [the alleged mole’s] claims will be debunked.”¹³¹⁴⁶

On April 24, 2025, Deel filed a separate civil suit against Rippling in the Delaware Superior Court (Case No. N25C-04-239) alleging defamation, libel, and deceptive trade practices, and claiming “hundreds of millions of dollars” in lost business.¹⁴¹⁵ Deel alleged Rippling had planted its own insider at Deel, solicited Deel employees for confidential information, and failed to properly remit customer payroll taxes.¹⁶ The Delaware case was settled on March 25, 2026 and dismissed without prejudice the same day.¹⁷

In the federal case, Deel filed counterclaims alleging cybersquatting and false advertising over Rippling’s acquisition and redirection of the domain “deal.com” to Rippling’s own site, along with claims that Rippling used fraudulent means to access Deel’s internal systems.¹⁸ Deel separately alleged that a Rippling “competitive intelligence manager” used a fake identity to access Deel’s platform 58 times to obtain proprietary documents.¹⁹

The DOJ Criminal Investigation

In January 2026, multiple outlets reported that the U.S. Attorney for the Northern District of California had opened a criminal investigation into Deel and issued grand jury subpoenas seeking information about the alleged espionage scheme.¹⁹ The reported focus includes potential violations of the Economic Espionage Act, the Computer Fraud and Abuse Act, wire fraud, and conspiracy.¹¹

A Deel spokeswoman said the company was “not aware of any investigation” but indicated it would cooperate.¹⁹ Deel’s CEO has retained William Frentzen, a partner at Morrison Foerster’s white-collar defense group and former chief of the corporate and securities fraud unit at the U.S. Attorney’s Office for the Northern District of California.¹¹

Where the Case Stands

The federal case in San Francisco is before Judge Charles R. Breyer. Deel filed two motions to dismiss in April 2025, one arguing the dispute belonged in Ireland under forum non conveniens and another under Rule 12(b)(6) that Rippling had failed to state a claim.¹⁶ Judge Breyer denied both, ruling that Rippling had adequately alleged racketeering and trade secret violations for the case to proceed.²⁰ No trial date has been set as of mid-2026. The parties agreed early on that neither side would seek to stay discovery while motions to dismiss were pending, so fact-gathering has been underway.¹

Rippling is represented by Alex Spiro of Quinn Emanuel, a former Manhattan prosecutor. CEO Parker Conrad has framed the suit as a “public stand” to prevent corporate espionage from becoming “normalized” in the tech industry.²¹²²²³

1
CourtListener. People Center, Inc. v. Deel, Inc.
2
FindLaw. Lawsuit Over Corporate Espionage Sounds Like a Raw Deel
3
Rippling. Lawsuit Alleges $12 Billion Unicorn Deel Cultivated Spy
4
HR Brew. Rippling Deel Corporate Espionage
5
Business Insider. Rippling Employee Spying Deel Court Affidavit
6
Calcalist. Deel Rippling Corporate Espionage
7
Fortune. Alleged Deel Spy Court Filing Admits Passing Information
8
Rippling. Exhibits to O’Brien Affidavit
9
Protos. Deel Allegedly Paid €5,000 in Crypto to Spy on Competitor
10
Rippling. First Amended Complaint
11
TechCrunch. The Rippling Deel Corporate Spying Scandal May Have Taken Another Wild Turn
12
Axios. VC Court Deel Rippling HR Software
13
HR Dive. Corporate Spy Confession HR Deel Rippling Lawsuit
14
Axios. Deel Rippling Lawsuit
15
Forbes. Deel’s Billionaire Cofounders Just Got $500 Million Richer
16
TechCrunch. Deel Files Countersuit Against Rippling
17
Delaware Courts. Deel, Inc. v. People Center, Inc. Docket Report
18
Calcalist. Deel Counterclaims Against Rippling
19
PYMNTS. Justice Department Investigates Allegations That Deel Recruited Spy at Rival Firm Rippling
20
Bloomberg Law. Rippling to Advance Corporate Espionage Lawsuit Against Deel
21
San Francisco Business Journal. Rippling GIC Bridge Forum San Francisco
22
Irish Times. Deel Executives Can Be Removed as Defendants in Espionage Case Brought by Rival Rippling
23
Echo Live. Tech Executives Should Not Be Defendants in Corporate Spy Case