The biggest upgrade issue is almost certainly going to be your plugins. WP 2.8 effectively caused some plugins to stop functioning properly and, in some cases, actively interfere with the site’s display and Admin. That’s not because of an issue with WP but because these plugins were not coded in line with the published WP plugin specs. 2.8 merely highlighted the problems.
So I’d suggest that you check all of your plugins to see if they are currently, and officially, compatible with 2.8. Be wary of any plugin that hasn’t been updated for a year or 2. Assume that you won’t be able to use these plugins and see if you can source suitable, compatible, alternatives.
Do the same checks on your theme.
If you try upgrading again, deactivate all plugins as before but, post-upgrade do not activate any plugins that are potentially incompatible. Stick with the ones you know are good at first. Activate them one-by-one and check the site and Admin area thoroughly after each re-activation.
Then turn your attention to the potentially incompatible plugins. At this point, you have to decide whether any of them is worth the risk. If it is, again, activate them one-by-one and check the site and Admin area thoroughly after each re-activation. If possible, leave the site running for a day or so before trying the next re-activation (I’ve known some cases where problems only kicked in after a day or so).
Given the recent hack warning and the fact that versions 2.5 – 2.7 appear to be most at risk, I’d echo Otto’s advice and strongly recommend that you upgrade asap. Even if it means living without some of your favourite plugins.
A clean working site minus a few fancy features is far better than a hacked site.