Companies like this are why breaches can be so devastating (financially and privacy-wise) to the general public [1].
If you know who their credit card processor is, you should go directly to them and report the problematic business. You can also go to the credit card company sites and contact them directly. If you know whom their QSA is, I would also contact the credit card companies about the QSA and they can investigate whether his PCI auditor status should be revoked. [2]
It is in the credit card companies best interest to investigate things like this which is why the channels exist to report these instances.
For reference, requirement no. 3 of the PCI standards cover the appropriate procedures for storing this type of information [3].
If you know who their credit card processor is, you should go directly to them and report the problematic business. You can also go to the credit card company sites and contact them directly. If you know whom their QSA is, I would also contact the credit card companies about the QSA and they can investigate whether his PCI auditor status should be revoked. [2]
It is in the credit card companies best interest to investigate things like this which is why the channels exist to report these instances.
For reference, requirement no. 3 of the PCI standards cover the appropriate procedures for storing this type of information [3].
IANAL and all that..
[1] See the first comment of https://news.ycombinator.com/item?id=14401825
[2] https://www.pcicomplianceguide.org/how-do-i-report-a-pci-vio...
[3] See page 36 of https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2....