This is hyperbole. His customers are probably running their business, not monitoring the news for info on every SaaS they use. PCI compliance most likely isn't what keeps them there: it's friction in leaving, customer service, possibly features they don't find elsewhere. There isn't some PCI police that has a list of all their customers and will email them.

If customers are lost, it'll be a trickle. Once they identify what's up, they'll be all hands on deck to fix it, and this amazing competitive advantage you feel fell into your lap will disappear. On the other hand, maybe he'll ignore it - I promise you there will be customers that really don't care. Yeah, they should. But they won't. Your competitor will still be in business

I'd turn it into a marketing advantage, not treat it like a magic torpedo. Many of our competitors outsource their programming or are resellers of one of our competitor's services. (In our industry, whoever has your data has a list of your customers, so important to control who has access to that information) In our pitch, I tell them to ask whoever they do business with, even if it isn't us, if they outsource their operation and who controls the data. In your situation, point out that some companies in your space, without naming names, store their payment data incorrectly, and why that's bad. Then hit them with how you are PCI compliant.

Another thing to consider: if your magic torpedo scenario doesn't play out, then what? There's people out there using a provider that stores payment details insecurely. Announce it publicly, and you've just made them a target for a breach - big payday for those hackers. Muahahahah, I've killed my competitor! Maybe, maybe not, but you've also just screwed over those customers. Even if they leave that provider, when they find out the reason their credit card is being abused is due to your disclosure, there's 0 chance you'll their business, and it could have long term PR repercussions. Hell, depending on your jurisdiction, potential legal ones.

(Yes, everyone will say it's not altron's fault - it's his competitor's. It's both at that point. If I tell the world about someone I don't like who leaves their house unlocked, I'm an asshole, and don't deserve to be liked)

About the only situation where I feel this works out well for you is to contact the customers of theirs that you know, and tell them directly.