Acting Inspector General John Kelly said in a letter addressed to Sen. Elizabeth Warren, D-Mass., on Wednesday that he would review the Federal Emergency Management Agency’s awards to Bronze Star LLC. He said he recognizes concerns that the Saint Cloud, Florida-based company was awarded contracts despite its lack of experience.

The Associated Press first reported last month that Bronze Star failed to deliver the emergency tarps and plastic sheeting needed to cover tens of thousands of Puerto Rican homes damaged by the storm’s winds. FEMA ultimately terminated the contracts this month without paying any money, but the episode caused a delay of four weeks.

“As a result of these botched contracts, many Puerto Ricans have failed to get the tents, tarps, and temporary roofing supplies they desperately need,” Warren said in a statement. “The federal government’s response to the needs of the U.S. citizens of Puerto Rico remains unconscionably inadequate, and the investigation of these contracts cannot come soon enough.”

The review was requested this month by Democratic senators, including Warren, Bob Menendez of New Jersey, Richard Blumenthal of Connecticut, Catherine Cortez Masto of Nevada, Dick Durbin of Illinois and Tammy Baldwin of Wisconsin. They are joined by Sen. Bernie Sanders, an independent from Vermont.

The senior Democrat on the Senate Homeland Security and Governmental Affairs Committee, Claire McCaskill of Missouri, has also asked FEMA Administrator Brock Long, in a letter sent last month after AP’s report, to provide her with information on how FEMA evaluated Bronze Star.

It was not clear how thoroughly FEMA investigated Bronze Star or its ability to fulfill the contracts. Formed by two brothers in August, Bronze Star had never before won a government contract or delivered tarps or plastic sheeting. The address listed for the business is a single-family home in a residential subdivision.

Though both brothers are veterans, neither was awarded a Bronze Star, a medal earned by service members who serve heroically in combat.

FEMA awarded the company two contracts Oct. 10 to provide 500,000 tarps and 60,000 rolls of plastic sheeting. More than a half dozen others also bid, but FEMA said it could not provide details about their identity or their bids.

The Trump Organization denied the domain names were ever compromised. But a review of internet records by the AP and cybersecurity experts shows otherwise. And it was not until this past week, after the Trump camp was asked about it by the AP, that the last of the tampered-with addresses were repaired.

After the hack, computer users who visited the Trump-related addresses were unwittingly redirected to servers in St. Petersburg, Russia, that cybersecurity experts said contained malicious software commonly used to steal passwords or hold files for ransom. Whether anyone fell victim to such tactics is unclear.

A further mystery is who the hackers were and why they did it.

The discovery represents a new twist in the Russian hacking story, which up to now has focused mostly on what U.S. intelligence officials say was a campaign by the Kremlin to try to undermine Democrat Hillary Clinton’s candidacy and benefit Trump’s.

It is not known whether the hackers who tampered with the Trump addresses are the same ones who stole Democratic officials’ emails and embarrassed the party in the heat of the campaign last year. Nor is it clear whether the hackers were acting on behalf of the Russian government.

The affected addresses, or domain names, included donaldtrump.org, donaldtrumpexecutiveoffice.com, donaldtrumprealty.com and barrontrump.com. They were compromised in two waves of attacks in August and September 2013, according to the review of internet records.

The attacks took place as Trump was preparing to travel to Moscow for the Miss Universe pageant, which was held on Nov. 9, 2013, at a property owned by a wealthy Russian real estate developer.

Many of the addresses were not being used by Trump. Businesses and public figures commonly buy addresses for possible future use or to prevent them from falling into the hands of rivals or enemies. The Trump Organization and its affiliates own at least 3,300 in all.

According to security experts, the hackers hijacked the addresses by penetrating and altering the domain registration records housed at GoDaddy.com, a seller of web addresses.

Accounts at GoDaddy, like at any site that requires a user name and password, are often subject to malicious messages known as phishing attacks, which are designed to trick people to reveal that personal information to hackers.

Computer users who entered or clicked on one of those Trump addresses probably would have had no idea they were redirected to servers in Russia.

Within days after the AP asked the Trump Organization about the tampering, the affected web addresses were all corrected.

The White House referred questions to the Trump Organization. The FBI did not respond to a request for comment.

GoDaddy spokesman Nick Fuller said the company had no breaches of its system in 2013 and has measures in place to monitor for malicious activity. Fuller would not discuss any customers in particular.

Some cybersecurity experts said there is an outside chance the tampering was a probe — an attempt to test security for an eventual effort to gather information on Trump or his business dealings. But those experts were only guessing.

There was no evidence the hackers ultimately broke into server computers at the Trump Organization or other Trump interests.

“This is beyond me,” said Paul Vixie, CEO of the San Mateo, California-based internet security company Farsight Security Inc. “I have simply never seen a benefit accrue from an attack of this kind. I’m at loss, unless it’s a demonstration of capabilities.”

Vixie said the Trump Organization’s apparent failure to detect what was happening probably suggests inadequate cybersecurity at the company.

“There’s no way something like this could go by in the Bloomberg empire without this being seen,” Vixie said.

They filed a lawsuit Thursday in U.S. district court in Washington, D.C., on behalf of members of the House Committee on Oversight and Government Reform.

It accuses the acting head of the General Services Administration of violating a nearly 90-year-old law and preventing congressional oversight.

A spokeswoman said the GSA doesn’t comment on pending litigation.

The Trump Washington hotel in the federally-owned Old Post Office building lost more than $1 million dollars its first two months of operation. After Trump became president its fortunes reversed, turning a $1.97 million profit as of August.