The suicide bomber waited in line for the Easter Sunday breakfast buffet at Sri Lanka's Cinnamon Grand hotel, a hotel manager told AFP, before setting off the explosives strapped to his back.
"There was utter chaos" after the blast went off, the manager, who spoke on condition of anonymity since he wasn't allowed to speak for the company, added. He said, "We rushed all the injured to hospital in a very short time."
The restaurant was having one of its busiest days of the year and was full of families. The suicide bomber had registered the night before under the name Mohamed Azzam Mohamed.
"He came up to the top of the queue and set off the blast," the manager said. "One of our managers who was welcoming guests was among those killed instantly."
The bomber gave an address when he checked in that turned out to be false and claimed that he was in the city on business. Two other hotels, the Shangri-La Hotel and the Kingsbury, were hit by suicide bombers at about the same time, approximately 8:30 a.m., along with three churches packed with Christians worshipping during Easter Sunday services. Two additional bombs were ignited later in the day.
"Guests who had come for breakfast were lying on the floor, blood all over," an employee at Kingsbury Hotel told Reuters.
Sri Lankan Police Chief Puhuth Jayasundara sent a letter dated April 11 to police officers across the nation saying he'd been warned that suicide bombers planned to target "prominent churches" and the Indian High commission. The government of President Maithripala Sirisena said that they hadn't been aware of the warning until the bombs went off.
The warning came after Sri Lankan police arrested four men from NTJ in January and seized explosives and detonators stashed near a wildlife sanctuary.
According to Gunaratna, NTJ members traveled to the Middle East to join ISIS in Syria and Iraq.
Sri Lankan officials named NTJ but said they suspect the "small organization" had international support.
"We are now investigating the international support for them, and their other links, how they produced the suicide bombers here, and how they produced bombs like this," government spokesman Rajitha Senaratne told reporters on Monday.
Alto Labetubun, an anti-terrorism expert, told Reuters that the bombings bore the hallmarks of militant groups such as ISIS and al-Qaeda, citing the level of sophistication of the attacks.
"These synchronized attacks are out of the ordinary for Sri Lanka. Compared with similar attacks in the Middle East and Southeast Asia, it has the DNA of attacks carried out by Islamic State [ISIS] and al-Qaeda," he said.