wasd, you are in a bad situation here. I agree that it's highly unlikely that you can get legal redress for your predicament. Your employer knows this, which is why for whatever reason they have decided to withold payment.
The thing is, no matter what you do you're unlikely to ever work for your current employer again. So you shouldn't worry too much about that part, unless you think you can somehow get this relationship back on the rails, get paid, and go on as before (minus trust on your part of course).
I don't think waving confidential documents and threatening either your employer or the client will do much for you, all you'll accomplish is to get them to unite against you. However, I think you may be able to get some help from the client if you appeal to them directly. Have you ever been allowed to be in contact directly with the client, do you have any contact info for someone who can judge whether you have in reality been doing the work? Or can you deduce from the documents in your possession who is working on the project?
Chances are the clients don't even know you've been involved. If you get in touch and tell them politely that you've been doing the actual work (some sample included? code, document?) and that you're in a dire situation because you're not getting paid by the intermediary, chances are that they'll be on your side, and apply pressure to your employer. Only if that doesn't seem to be working at all should you even mention that your employer has been throwing their confidential documents around the world carelessly.
I recall a scandal when outsourcing was just starting, when workers in India complained to the University of California because they hadn't been paid in months. It turned out that their pay was minuscule, and there were at least FIVE layers of contractors lining their pockets on the way down. These people were handling sensitive patient data for a hospital, and the university had no idea the data was leaving the first contractor at all. Needless to say, they were paid promptly. But maybe in part because their story was also picked up by the press, and public outcry put pressure on the university.
So anyway, my advice would be to first try to get the client to help, by appearing to be very cooperative, informing them of what's going on behind their back, being concerned about the nature of the information being handed out carelessly. And if that doesn't work, by all means go to the press in the client's country and see if you can get some help there. It'd help if what you have in hand concerns not just the business interests of the client, but there's some angle of breaching the public's privacy or something like that.