EY Canada pulls a cyber report with AI-hallucinated references

EY Canada used a 2025 report on fraud and cyber threats in loyalty programs to market its cybersecurity work. In May 2026, researchers at GPTZero found that 16 of its 27 references were hallucinated. They estimated about 72% of the text was AI-generated. The report cited a McKinsey study that does not exist. It used the same $200 billion figure for two different things. Several footnotes led to dead pages or sources that did not support the claims. After the Financial Times reported the findings, EY Canada removed the report and said it was reviewing how it was approved.