All in all I'm not sure I believe in karma, but I do believe you should take the high road here. Simply reporting them doesn't fix it. But telling your competitor and reporting it as a PCI compliance issue from your company (because you do indeed have exposed credit card numbers in your possession) would be the route I would take.

Tell them and let them know you're prudently reporting it for your own sake.