I thought PCI compliance wasn't necessarily legally required, just that it was a contractual agreement between your company and the payment processor?

Regardless, I still feel reporting is the ethical thing to do.