What to do when you can't upgrade modules? I have some old sites running "dead" versions of modules in my drupal (I made the upgrade to the last current Drupal core version). 

But some of the modules used in this site are not longer supported or they need a "major" upgrade. This will break my site for sure, because some of them are used.

What do you think it's the best approach to fix this ? Because this represents a serious risk for the security of the website.
Major upgrades of modules should not be a problem if the module is still supported. Just do drush up moduleshortname in the CLI (or replace the old code in the module directory with the new if you don't have drush). Updating a module is integrated in Drupal. If you do this manually (drush will do it automatically) just make sure you run Update on your site after updating the module (Update is linked to on Reports->Status Report page if you need to run it). Update should take of all incremental updates of the module, its schema, and the data in the schema, automatically. Unless there are a bug in the code to update the module, there should be no data loss.

Modules that are no longer supported, especially if they're unsupported because they have security vulnerabilities the maintainer did not fix, are a problem.

The first thing to do is to review the unsupported module and the features it brings to your site.  Is this features your site cannot live without?  If the answer is "no", just disable and uninstall it.

If the unsupported module provides functionality you need, try to find some supported replacement for each unsupported module.  If you find a replacement, you need to migrate all data from the old unsupported module to the new one.  If you're not a developer, you may need to hire a consultant to help you with migration.

If you don't find a replacement, and you are a developer, you may consider fixing the insecure module.  If you follow the process for dealing with unsupported projects, and work with the security team, you should be able to fix the problem. The security team is a helpful bunch and may provide some guidance.

As a last resort, you may hire a consultant to fix an insecure module you absolutely need, forking the result as a custom module for your site.

As already described by Darvanen, you need to do all this on a development server first and only repeat the procedure on your production server when you're sure the update did not damage anything. And make a backup before you start, just in case.