I think I already know the answer to this but thought I would ask anyway:
We have a file that got added to a Mercurial repository with sensitive information in it. I
No, you can't. Read the changes that should have never been section of the mercurial red book about it; and particularly the what about sensitive changes that escape subsection, which contains this paragraph:
Mercurial also does not provide a way to make a file or changeset completely disappear from history, because there is no way to enforce its disappearance; someone could easily modify their copy of Mercurial to ignore such directives. In addition, even if Mercurial provided such a capability, someone who simply hadn't pulled a “make this file disappear” changeset wouldn't be affected by it, nor would web crawlers visiting at the wrong time, disk backups, or other mechanisms. Indeed, no distributed revision control system can make data reliably vanish. Providing the illusion of such control could easily give a false sense of security, and be worse than not providing it at all.
The usual way to revert committed changes is supported by mercurial through the backout command (again, mercurial book: dealing with committed changes) but the information does not disappear from the repository: since you never know who exactly cloned your repository, that would give a false sense of security, as explained above.