AI Risk Wire

Cases › made things up › LR-2026-0536

EY withdraws report over AI hallucination errors, fake data and citations

Preliminary Why: Publisher not yet named · subject to change

Status: fix reported

Severity minor
Reported 14 May 2026
Industry professional services

No source states: loss or records, developer and model, agent tool, could do, deployer.

Ernst & Young (EY) published a study on loyalty rewards programmes, written by its consultants in Canada to market their cybersecurity business. The company said the study was not connected to any EY client project. Researchers at the AI detection startup GPTZero found that the report contained made-up data points, misattributed citations, and a cited McKinsey report that does not exist. EY removed the report from its website and said it was reviewing the circumstances that led to its publication. EY said it takes the accuracy of its published content seriously and has an organisation-wide commitment to the responsible use of AI.

What happened

1 · What it was doingEY consultants in Canada published a study on loyalty rewards programmes to market their cybersecurity business.
2 · What went wrongThe report contained made-up data points, misattributed citations and a cited McKinsey report that does not exist.
3 · How it was caughtGPTZero researchers reported the errors in a blog post published on Thursday, May 14.

What was done

EY removed the report from its website and said it was reviewing the circumstances that led to its publication.
Fix reported

“Report removed from the EY website; the firm is reviewing the circumstances that led to its publication”

Risks

Made-up output relied on
Primary36 incidents

Read from the sources; not yet reviewed by a person.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Application

Grounding and fact checks · Human approval for high-impact actions · Output filtering and redaction · People told they are dealing with AI

Evidence

No source states: what it reached or did, when it happened, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off.

Show the full account: 3 items from the primary sources

What happened, in order

  1. Thursday, May 14 GPTZero researchers published a blog post reporting the fabricated content.

Not dated in the sources:

  • EY consultants published the study.
  • EY removed the report from its website in response and said it was reviewing the circumstances that led to its publication.
Show every field, with its source and grade

What happened

Earliest source we hold
2026-05-14
D inferred by us from the described behaviour, reason shown
Who caught it
an outside party
C one secondary source states it
What was done
Report removed from the EY website; the firm is reviewing the circumstances that led to its publication
C one secondary source states it
What went wrong
made things up
C one secondary source states it
primary risk
RK14
D inferred by us from the described behaviour, reason shown

Impact

Severity
minor
D inferred by us from the described behaviour, reason shown

Context

Industry
professional services
C one secondary source states it

Notes on gaps

The Deloitte and Sullivan & Cromwell cases are separate incidents and were excluded.

LR-2026-0536 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON