Inform them that your obligation to approach a mutually convenient solution discreetly is about to expire within 48-72 hours (depending on scope; your call); af

Inform them that your obligation to approach a mutually convenient solution discreetly is about to expire within 48-72 hours (depending on scope; your call); after which you will disclose, and syndicate the security hole to the public at large. Inform them that you're dissatisfied by their manner of handling sensitive customer data, and the hole might already have affected existing customers without their knowledge. And finally, inform them that should they be willing, but unable to provide a fix in timely manner, I'm available for security consultation, and implementation; e-mail me at sdrinf [at] gmail for a free initial consultation ;)