1. FALSE ADVERTISING: If the competitor advertises PCI compliance --- or even advertises "we're secure" --- that's very possibly false advertising in violation of Section 43(a) of the Lanham Act [1] and perhaps various state deceptive-trade-practices statutes. Some years back, U-Haul got a $44 million judgment against a competitor whose ads for rental trucks included inaccurate dimensions. The damages award was tied to the cost of corrective advertising that U-Haul would theoretically have to do. [2]

2. TORTIOUS INTERFERENCE COUNTERCLAIM: The competitor's terms of service with the customer probably include restrictions on access to the competitor's system. The competitor thus might claim that the OP's accessing of the customer's data constituted "tortious interference" with the competitor-customer contract. [3] The competitor's lawyers are likely to pursue such a claim, because it lets them reframe the issue in their favor, it might allow them greater discovery from the OP, and it could also lead to a punitive-damages award. (Whether a tortious-interference claim would succeed depends on a lot of facts that we don't have.)

3. CFAA VIOLATION: As others have pointed out, depending on the circumstances, the OP might have violated the Computer Fraud and Abuse Act. [4]

All of the above assumes U.S. law applies.

[1] http://scholarship.law.duke.edu/cgi/viewcontent.cgi?article=...

[2] U-Haul v. Jartran, 793 F. 2d 1034, 1041 (9th Cir. 1986) http://scholar.google.com/scholar_case?case=1381884152605222...

[3] https://en.wikipedia.org/wiki/Tortious_interference

[4] https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act