Cyber-attack investigation has leads but no suspects