Islamic State has claimed responsibility for the Easter bombings in Sri Lanka that killed more than 320 people, the group’s Amaq news agency has said.

The terrorist group released a photograph of the alleged ringleader of the attacks, as well as what it said was the nom de guerre of each attacker. The group said the bombers targeted citizens of the US-led coalition fighting Isis and referred to Easter as an “infidel holiday”.

Experts have said the suicide bombings of three churches and three luxury hotels bear the hallmarks of the group.

Sri Lanka’s prime minister said on Tuesday there were more explosives and militants “out there”. Ranil Wickremesinghe also acknowledged there was a prior warning of the attacks and said some officials would likely lose their jobs over intelligence lapses.

He also revealed there was a fourth failed attack on another major hotel and that the Indian embassy was also a possible target.

Footage has also emerged of a suspected suicide bomber entering St Sebastian’s church in Negombo moments before the attack there. The subsequent explosion, not shown in the video, was the deadliest of the series of coordinated bombings in Sri Lanka on Easter Sunday, with at least 110 people thought to have been killed. The footage was broadcast widely on Sri Lankan news channels.

Play Video 0:30 CCTV footage shows suspected Sri Lanka suicide bomber entering church – video

Earlier, Sri Lanka’s defence minister, Ruwan Wijewardene, said the attacks were a response to the recent mass shooting of Muslim worshippers in Christchurch in New Zealand.

Sri Lanka bombings – a timeline and visual guide Read more

“The preliminary investigations have revealed that what happened in Sri Lanka was in retaliation for the attack against Muslims in Christchurch,” Wijewardene told a special sitting of parliament, referring to the terrorist attack by a white supremacist in March in which 50 people were killed. The minister did not present any evidence for his claim.

An intelligence memo circulated to some in government in the weeks before the attack noted that one member of the terrorist group, since named as a perpetrator, had started to update his social media accounts with extremist content after the New Zealand shootings.

But terrorism researchers have said the sophisticated nature of the attack and the equipment used would probably have required months of preparation, including target reconnaissance, recruiting of the suicide bombers and obtaining explosives.

Facebook Twitter Pinterest A soldier stands guard during a funeral service at St Sebastian’s church in Negombo on Tuesday. Photograph: Jewel Samad/AFP/Getty Images

One emerging scenario among western and south Asian security officials who spoke to the Guardian on Monday – before the Isis claim – was that the global group had established a connection with existing Sri Lankan networks of extremists already attracted by its ideology, but who lacked organisation and experience.

Sri Lankan veterans who had fought for Isis in Syria or Iraq may have acted as “connectors”, one South Asian official said, pointing to the group’s operations in Bangladesh in recent years as an example of how it had learned to “subcontract” to local militants.

There is a thread running through Sri Lanka's cycles of violence | Farah Mihlar Read more

The Isis claim was issued used terms familiar from previous such statements, citing “security sources” and describing the attackers as “fighters” of the group.

Until Isis began to lose its most important bases in the Middle East, the group’s claims of responsibility were treated as reliable indicators that it had been directly involved in an attack. In recent years, however, an increasing number of claims have been made for operations that either had nothing to do with the organisation or were only tenuously linked to it.

Wijewardene also told parliament on Tuesday that the death toll had climbed to 321 people – including 38 foreigners – and reiterated that the prime minister and other key officials were never told about the possibility of an impending attack.

Sri Lankans have started to bury the dead from the string of bombings. Tuesday has been declared a national day of mourning and white flags were hung from buildings across Colombo as a three-minute silence was held from 8.30am, about the time of the first of Sunday’s bombings.

Facebook Twitter Pinterest Security personnel observe the three-minute silence in Colombo on Tuesday. Photograph: Dinuka Liyanawatte/Reuters

At St Sebastian’s in Negombo, more than 20 coffins were brought in for individual services in the run-up to a mass memorial. “There are so many bodies that we can’t accommodate them all at once,” Anthony Jayakody, the auxiliary bishop of Colombo, told Agence France-Presse.

A few hundred metres away, a palm-lined lot donated to the church had been turned into a mass burial site, where 22 bodies were laid out by 1pm local time. They were marked out by flower arrangements and numbered wooden crosses. “They have died in one place and our hierarchy has decided to bury them in one place,” said Father Sanjeev Senananya, standing by the site.

Sri Lanka: boy, 8, related to Bangladeshi leader and UK MP, among young victims Read more

The small, majority-Catholic city was awash with clerics and mourners dressed in white, who walked past rows of leaflets pasted on the walls commemorating victims. The narrow lanes that criss-crossed the area were watched by security forces in camouflage uniforms carrying rifles. “Every second house is having a funeral today,” said a schoolteacher who gave his name as Amantha.

Flags were lowered to half-mast on government buildings, and people bowed their heads but tensions remained high. Bomb disposal squads were called to Kollupitiya railway station in Colombo after an unattended package was found on a train. The US embassy urged people to stay away from the area before the all-clear was given.

A state of emergency has been introduced and 40 arrests made, with the second overnight curfew lifted at 4am.

Investigators had been hunting for clues on whether a local Islamist group named as the chief suspect in the attacks – National Thowheeth Jama’ath – received “international support”, according to the cabinet minister and government spokesman Rajitha Senaratne.

As security forces continued combing Colombo for explosives, focus was shifting to the role that infighting within the government may have played in allowing the attacks to occur.

Sri Lanka’s government has been divided into factions since a constitutional crisis late last year, when the prime minister and his allies stopped being invited to meetings of the country’s top security officials.