When you say "the boss", do you mean your boss at the consulting agency, or your former boss at the client company? This is important because it determines how you proceed.
In either case, if it's practical, find a local shredding agency (apparently UPS will do it, according to other comments) and get a quote, and ask whoever it is if such a service is sufficient. Also get confirmation that you can expense the charge to the company so you're not paying for it yourself; this is a work matter so the company should pay for it. If this approach doesn't work for whatever reason:
If your boss at the consulting agency is the one asking you to do this, then just do it, but do it on work time. This is part of your work responsibilities, so you deserve to be paid for it. If you're not currently on an assignment then do it as part of your office responsibilities; if you are currently on another assignment then inform your boss that you'll need unbillable hours to do this (or billable to the previous client, however they want to arrange it). If you're salaried by the consulting agency, then just do it and count it as your working hours and figure out with your boss at the consulting company how to report this to your client (maybe it's unbillable to the new client and the company takes the hit). Anyway, you deserve to be paid for it.
If your (former) boss at the client company is the one asking you to do it, inform the consulting company of the issue, just as you've done here: you sent the invoice, billed the hours, and it's all finalized, and now they're asking for more hours. You don't want to say the wrong thing and potentially burn this bridge for the consulting company in the future without approval from the consulting company. Let them deal with it. You may make suggestions to your handler at the consulting company that have been mentioned in other answers, such as securely sending back the pages to the client (at someone else's expense of course, not yours) or burning the pages, or whatnot, but let the consulting company decide how to proceed; don't communicate directly with the client if you can at all avoid it, except to tell them you're looking into the best way to handle the situation and assure them you won't dispose of their confidential IP insecurely.