The study, which was used by EY consultants in Canada to market their cyber security business, used made-up data, misattributed citations and referenced a McKinsey report that doesn't exist.