in my humble opinion - you should leave it alone - it is illegal to break into their network regardless of your good intentions.

also, from the limited description you've given of them, it's unlikely they'd take to kindly to you demonstrating everything they know is wrong.

although you hear some stories of white/grey hats breaking into systems and then getting hired to fix them - this is the exception rather than the rule.  Leave them to learn the hard way.

<greyhat>
....or figure out a way to do it very anonymously and send them a screenshot of their data
</greyhat>

Think you might be right there...

On the other side of the coin, if they're only willing to be reactive rather than preventative you should be in a win-win situation (providing you don't have a contract that states you'll keep them secure/operational/etc.). Often clients not willing to pay up front end up paying more in the long run; plus if their systems just got well and truely hosed it can make your negotiations easier for fixing the issue

If you really want to get them to do the preventative thing you could do a quick risk assessment and make an estimate of what it'll cost them if it goes wrong, if you can compare that to the cost of a solution it might make negotiations with the money men easier. Alternatively depending on their industry/business they may already be in breach of regulatory requirements...

In terms of the whole grey-hat thing: I'd leave well enough alone. If they don't want to act on your concerns either walk away completely, or if the pay check is good document your concerns in writing and wait for 'I told you so'. Getting a criminal record isn't going to make them any more secure.

well done - that's a hard thing to do when it's family/friends you're working with.

sounds like you've made the right decision.

Sounds like you've already demonstrated the business impact.  "I'll work for you on one condition, you give me the $$ to fix this mess.  Otherwise, I leave and you pay a contractor market rates for them to maintain your system."  And just to echo everyone else here, I wouldn't even consider the "live demonstration" tactic.  It'd be just your luck that the first dollar they spend in regards to security is an investigator to track down who broke into their systems.