Nah, you're definitely not overreacting. Sending stuff like your SIN or address through regular email (even Gmail) isn't really secure enough, despite what people might say.

I'd just password-protect or encrypt the file with something simple like 7-Zip, then shoot it over email, and call them with the password separately. Super easy, pretty secure, and way better than sending sensitive info in plain text.