Everyone is wondering how Stormy Daniels's lawyer, Michael Avenatti, obtained the bombshell information on Trump lawyer Michael Cohen's financial dealings that he released Tuesday.

Experts said it was likely from what is known as a "Suspicious Activity Report."

The Treasury Department has already opened an internal investigation into whether anyone leaked the information to Avenatti.

On Tuesday the attorney for adult-film actress Stormy Daniels set off an unlikely firestorm.

His report revealed stunning details about President Donald Trump's personal lawyer, Michael Cohen, that could spark major ramifications for the president and his attorney as they endure legal battles on several fronts.

But how was it that Michael Avenatti, Daniels's lawyer, came to obtain such sensitive information?

'Project Sunlight'

Avenatti revealed in a report titled "Project Sunlight" that the same Cohen shell company that was used for the $130,000 hush-money payment to Daniels — who said she'd had a 2006 affair with Trump — just before the 2016 presidential election received payments from telecom titan AT&T, pharmaceutical giant Novartis, the Russian-tied investment firm Columbus Nova, and Korea Aerospace Industries in excess of $1.2 million.

The companies all subsequently confirmed the payments they made to Cohen through Essential Consultants LLC, Cohen's shell company, though they added a series of caveats.

"Michael Cohen appears to be selling access to the president of the United States," Avenatti said Wednesday, pointing to AT&T and Novartis. He told MSNBC's "Morning Joe" that he didn't have new information on possible payments to women, but suggested in his initial report that the payment from Columbus Nova may have served as a reimbursement for the Daniels payment.

Avenatti did not make clear how he obtained the information, which was subsequently confirmed by The New York Times, NBC News, and other outlets. Avenatti did not respond to a request for comment from Business Insider.

Soon after the attorney's revelations, CNN reported that special counsel Robert Mueller had questioned Viktor Vekselberg, a Russian businessman linked to Columbus Nova, about the investment firm's payments to Cohen. In a statement, Columbus Nova strongly denied that Vekselberg had any involvement with its hiring of Cohen.

Meanwhile, Novartis, the pharmaceutical company, said it was also questioned by the special counsel about the payments late last year. The company said it believed its involvement in Mueller's investigation was wrapped up.

"The bigger picture is that we don't know as we sit here today the full extent of the deposits," Avenatti said Wednesday. "Where did the money go? Did all of it go to Michael Cohen? Did some of it go back to the Trump Organization? Did some of it ultimately find its way to the president?"

How did Avenatti get this incredible information?

As for the source of Avenatti's information, one expert told Business Insider that it most likely came from multiple "Suspicious Activity Reports" filed with the Treasury Department's Financial Crimes Enforcement Network.

Those reports can be filed by banks, casinos, and other entities, and their purpose is to detect illegal behaviors. As The Washington Post reported Wednesday, officials often scan and aggregate those reports so they can later be accessed, and they can be requested by law-enforcement officials, bank regulators, and intelligence agencies.

Michael Cohen. Lucas Jackson/Reuters Banks are required to file such reports if a transaction in excess of $10,000 "has no business or apparent lawful purpose or is not the type of transaction that the particular customer would normally be expected to engage in, and the bank knows of no reasonable explanation for the transaction after examining the available facts, including the background and possible purpose of the transaction."

Avenatti, meanwhile, has been agitating for the release of three "Suspicious Activity Reports."

"Why is no media outlet doing a story on the refusal of the Treasury Department to release to the public the 3 Suspicious Activity Reports that were filed concerning Essential Consultants, LLC's bank account?" he tweeted. "This deserves immediate attention. The SARs should be released now."

"The confidentiality concern here is ZERO," he said in a subsequent reply. "Mr. Cohen learned that a SAR had been filed when the WSJ reported on it months ago. The SARs should be released to the public now."

Mitchell Epner, a former assistant US attorney for the District of New Jersey and now a lawyer at Rottenberg Lipman Rich, told Business Insider it was "very interesting" that Avenatti has pushed publicly for the release of those records.

"The fact that there is a suspicious activity report ordinarily is not public information," he said. "And certainly the number of suspicious activity reports would not be public information. And his saying that there were three is a very specific data point. Which leads me to conclude that either he's seen them, or somebody has read them to him, or somebody has described them in detail."

Epner said Avenatti appears to be "detail-oriented" and wouldn't be agitating for such a release if he felt they didn't exist or that he would later regret their release.

The bombshell revelation led to a Treasury Department inspector-general investigation

As to who has access to those reports, Epner said they could fall to the banks that generated them, the Treasury Department, law-enforcement agencies that obtained them, and possibly any individuals or their attorneys who were confronted with the reports during the course of an investigation such as the Mueller probe or the separate criminal investigation into Cohen taking place in the Southern District of New York.

Based on Novartis's statement, it's clear that Mueller has been aware of the payments since at least late last year.

On Wednesday, the Treasury Department's inspector general announced it was investigating whether someone internal leaked the documents to Avenatti.

Avenatti speaking to reporters outside of federal court in Manhattan. Spencer Platt/Getty Images

Rich Delmar, counsel to the inspector general, told The Post that the office was "inquiring into allegations" that those reports were leaked.

Speaking to The Post, Avenatti said the "source or sources of our information is our work product, and nobody’s business."

Speaking with CNN's Anderson Cooper on Tuesday, Avenatti mentioned that while his robust media strategy has been criticized, it is "working in spades" because "we're so out front on this, people send us information, people want to help our cause."

"People contact us with information," he said.

Of course, such a leak would not be uncommon. And, as Daniel P. Stipano, former deputy chief counsel in the Treasury’s Office of the Comptroller of the Currency, told The Post, hundreds if not thousands of law enforcement and government officials have access to the database of reports.

It's still somewhat unclear how Avenatti obtained this information

Still, other experts seemed unsure of how Avenatti could have obtained the information.

Roland Riopelle, a former federal prosecutor with the US Attorney's Office for the Southern District of New York and a partner at Sercarz & Riopelle, said the information was something that could be obtained by subpoena or in discovery, but as far as Daniels's pending litigation and Cohen's case, that has yet to occur.

"So this is a bit of a mystery," he said, noting that Avenatti could have employed a private investigator to obtain the information. "Unless the FBI or US Attorney's Office is leaking information it has gotten by subpoena (very, very unlikely in my experience), I just don't know how Mr. Avenatti got this stuff."

Steven Feldman, a former assistant US attorney for the Southern District of New York who now works as a defense attorney, told Business Insider that Avenatti could have made a third-party-discovery request for the banking information in the pending California civil case between Daniels — whose real name is Stephanie Clifford — and Cohen.

"If you are the plaintiff's attorney, once you file the civil complaint, you now have civil subpoena power in the case," he said. "Plaintiff's counsel could have made the request in March 2018 to the appropriate bank, and that would be enough time for him to get the information back now."