Merchant kept my card information incorrectly - how/where/should I report?

I authorized one charge and gave my card info to the business owner over the phone. I did not authorize and future charges or to keep my card on file. Apparently he kept my card information on a piece of paper on his desk and manually typed it into his Clover system to make additional unauthorized charges in excess of $10k. I have already reported to my bank and Sheriff. Google led me to believe I should to report for PCI Compliance but not sure about that. Any other advice is appreciated.