Yes, I wondered the same thing! Aside from the legal implications, the OP seems to have some questionable ethics as well.
Of course, quitting is the other out, but I do think he has a moral obligation to prevent his company from handing any of this information over to the auditor.
- what this guy is asking for
- how that is in violation of the PCI data security standard
- explain that you are not able, and not allowed to provide this information
- explain that this likely means the auditor is a hack and steps need to be taken to get a proper auditor
To quote: if I don't provide this information we loose access to our payments platform