Is it legal to destroy other company's site or app. because they didn't pay your money in the past?
and also app they created is not secure.
The company is in another country.
.
.
.
If "No"
I'll still do that. I don't care.

No it's not, legal way to do it would be reporting it to officials, if customer data is in danger.

Otherwise just sell the info or blackmail them lol

Don't drop down on their level and be a douchebag, be better than them, either way karma will catch up with them eventually 😉

It'd be legal if it was an app you were developing for them and the contract specified that the ownership of all the app's IP would transfer after payment had been completely fulfilled by the client, because you'd be destroying *your* app after all. But the data stored by the app is property of your client, not yours: you can't touch that.

Long story short: since your client seems to have been already using the app for some time, I think it's too late. Whatever you do to destroy the app will probably have legal repercussions for you.

Lol why would you do work without pay?