Sri Lanka's prime minister says there is the possibility of more attacks following the weekend Easter bombings that left at least 321 people dead, and warned there are more explosives and militants "out there."

Ranil Wickremesinghe said Tuesday at a news conference that he believed the attacks had links to the Islamic State in Iraq and Syria after the militant group claimed responsibility for the bombings. However, ISIS did not give evidence for its claim.

Wickremesinghe told reporters the government's security agencies were monitoring Sri Lankans who had joined ISIS and returned home.

"We will be following up on [ISIS] claims. We believe there may be links."

Forty people were arrested on suspicion of links to the Easter bombings. They include the driver of a van allegedly used by the suicide bombers and the owner of a house where some of them were living.

The six near-simultaneous attacks on three churches and three luxury hotels, and three related blasts later Sunday, were the South Asian island nation's deadliest violence in a decade.

National day of mourning

Police spokesperson Ruwan Gunasekara said Tuesday, which was declared a national day of mourning, that the death toll had risen to 321, with hundreds more wounded.

UNICEF says at least 45 children were killed in the Sri Lanka Easter attacks, five of them foreigners.

Twenty children have also been hospitalized in Colombo.

UNICEF also says many children lost one or both parents in the attacks and would need psychological treatment.

Watch this security footage showing a suspected bomber walking into a church:

Security footage shows a suspected bomber walking into a Sri Lankan church with a backpack just before the Easter attacks. 0:55

The prime minister told the news conference that some officials will likely lose their jobs over intelligence lapses. Wickremesinghe acknowledged there was a prior warning, and said India's embassy was eyed as a possible target.

Later, President Maithripala Sirisena said he expected to change the heads of the country's defence forces within a day. "I will completely restructure the police and security forces in the coming weeks. I expect to change the heads of defence establishments within next 24 hours," Sirisena said a televised address to the nation.

"The security officials who got the intelligence report from a foreign nation did not share it with me. Appropriate actions would have been taken. I have decided to take stern action against these officials."

Word from international intelligence agencies that a local group was planning attacks apparently didn't reach the prime minister's office until after the massacre, exposing the continuing political turmoil in the highest levels of the Sri Lankan government.

On April 11, Priyalal Disanayaka, Sri Lanka's deputy inspector general of police, signed a letter addressed to the directors of four Sri Lankan security agencies, warning them that a local group was planning a suicide attack in the country.

On Monday, Sri Lanka's health minister held up a copy of the intelligence report while describing its contents, spurring questions about what Sri Lanka police had done to protect the public from an attack.

It was not immediately clear what steps were taken by any of these security directors. Disanayaka did not answer calls or messages seeking comment.

Wickremesinghe said he feared the massacre could unleash instability. He vowed to "vest all necessary powers with the defence forces" to act against those responsible.

A man cries as he walks behind the coffin of a bomb blast victim after a funeral service at St Sebastian's Church in Negombo on Tuesday, two days after a series of bomb blasts targeting churches and luxury hotels in Sri Lanka. (Jewel Samad/AFP/Getty Images)

Sri Lanka's minister of defence said the bombings were "carried out in retaliation" for attacks on mosques in Christchurch, New Zealand, on March 15. Ruwan Wijewardene made the comment to lawmakers in parliament without providing evidence or explaining where the information came from.

New Zealand Prime Minister Jacinda Ardern's office said she is aware of the comment, though it hasn't "seen any intelligence upon which such an assessment might be based." Ardern's office also added it understood "the Sri Lankan investigation into the attacks is in its early stages."

Heightened security in force

As Sri Lanka's leaders wrangled the aftermath of an apparent homegrown militant attack and massive intelligence failure, security was heightened Tuesday and the military was employing powers to make arrests it last used when the civil war ended in 2009.

Heightened security was evident at an international airport outside the capital where security personnel walked explosive-sniffing dogs and checked car trunks and questioned drivers on roads nearby. Police also ordered that anyone leaving a parked car unattended on the street must put a note with their phone number on the windscreen, and post officers were not accepting pre-wrapped parcels.

A block on most social media since the attacks has left a vacuum of information, fuelling confusion and giving little reassurance the danger had passed. Even after an overnight curfew was lifted, the streets of central Colombo were mostly deserted Tuesday and shops closed as armed soldiers stood guard.

We placed our hands on our heads when we came to know that these deaths could have been avoided. -Cardinal Malcolm Ranjith

The bodies of seven suicide bombers were recovered and authorities said they were all Sri Lankans, but they also strongly suspect foreign links.

Motive behind attacks unclear

Also unclear was a motive. The history of Buddhist-majority Sri Lanka, a country of 21 million including large Hindu, Muslim and Christian minorities, is rife with ethnic and sectarian conflict.

In the 26-year civil war, the Tamil Tigers, a powerful rebel army known for using suicide bombers, was finally crushed by the government in 2009 but had little history of targeting Christians. Anti-Muslim bigotry fed by Buddhist nationalists has swept the country recently, but there is no history of Islamic militancy. Its small Christian community has seen only scattered incidents of harassment.

Military personnel stand guard outside St Sebastian's Church in Negombo. The president of Sri Lanka has declared Tuesday a day of mourning. (Ishara S. Kodikara/AFP/Getty Images)

Two of the stricken churches are Catholic and one Protestant. The three hotels and one of the churches, St. Anthony's Shrine, are frequented by foreigners. Tourism Minister John Amaratunga said 39 foreigners were killed, although the foreign ministry gave the figure as 31. The reason for the discrepancy wasn't clear, but some victims were dual nationals.

The scale of the violence recalled the worst days of the civil war, when the Tamil Tigers, from the ethnic Tamil minority, sought independence from the Sinhalese-dominated, majority Buddhist country. The Tamils are Hindu, Muslim and Christian.

The six near-simultaneous blasts were set off Sunday morning at St. Anthony's and the Cinnamon Grand, Shangri-La and Kingsbury hotels in Colombo, as well as the two churches outside Colombo. They collapsed ceilings and blew out windows, killing worshippers and hotel guests, and leaving behind scenes of smoke, soot, blood, broken glass, screams and wailing alarms.

A woman is helped after she collapsed as silence is observed as a tribute to victims of the attacks in Sri Lanka on Tuesday. (Dinuka Liyanawatte/Reuters)

The military confirmed two other related blasts, one near an overpass and another at a guesthouse where two people were killed. A ninth blast, which killed three police officers, was set off by occupants of a safe house trying to evade arrest, authorities said.

Cardinal Malcolm Ranjith, the archbishop of Colombo, said at least 110 of the dead were killed at St. Sebastian's, making it the deadliest of the attacks.