Nuclear power plants, chemical plants, defense contractors and other highly sensitive industries and workers are leaking information through their pagers, a new report shows.

Pagers have been out of vogue with the public since the rise of the cellphone but are still used to send automated messages from industrial systems or building automation systems. They are a way to make sure employees can get critical updates — including alarms — even when they are away from consoles. 

{mosads}But legacy pager systems don’t use encryption to send data. Researchers at Trend Micro note that with little more than a $20 dongle anyone can intercept and understand the messages. 

“Potential abuse of this information leaking out would involve malicious actors who want to break into a facility. To get in, they could monitor the building’s temperature settings, lighting settings, and other sensors and then alter those settings when no one is inside the building,” they wrote of building systems that still rely on pagers in their report released Tuesday. 

Looking at the pagers used by nuclear power plants, Trend Micro received information that could be useful in an attack. They were informed when redundant systems went offline and when pumps slowed, as well as about leaks and medical emergencies — information that could allow an attacker to pose as mechanical or medical staff. 

One chemical plant leaked information about the functions of a nearby dam. A defense contractor whose employees relied on an email-to-pager system leaked emails and addresses from 1,400 accounts. Information on employees could be used to trick them into surrendering data, access or account transfers. 

The report notes that “[T]he United States is the only country wherein nuclear plants continue to send paging messages.”

Trend Micro recommends that companies tied to using pagers should invest in encryption and data authentication and clamp down on the way the email-to-pager feature is used.