It's bad but not tragic. If your mailserver and theirs are both set up to use TLS connections by default, it's likely that your data was not available in plaint

It's bad but not tragic. If your mailserver and theirs are both set up to use TLS connections by default, it's likely that your data was not available in plaintext on a public network. However the problem with opportunistic encryption is that while most service providers do set up their systems like that, it's not guaranteed. Still, I'm mildly surprised that Braintree is not following the 'secure administrative login' pattern that most banks use for that type of account management information; since that reduces the risk exposure. TL;DR they should make you log in to their https website.