It said an official had indicated that contractors who had had access to the leaked documents were now being looked at, with their mobile device and email logs likely to be examined.
Former NSA contractor-turned-whistleblower Edward Snowden tweeted about a report that showed a leak of cyber tools had taken place in 2015 by an unknown individual. This was apart from Harold Martin who was found to be hoarding NSA documents in his home and is now in custody after being indicted.
US officials have accused Russia of being behind leaks of material from the Democratic party during the presidential election process last year.
Also last year, a group called Shadow Brokers, suspected of having links to Russia, leaked a number of exploits that were found to be NSA-created tools.
Another aspect of the Vault 7 dump that has raised concern is the naming of the US consulate in Frankfurt as housing a hacking hub. US officials have admitted the consulate was home to a CIA base.
The office of Germany's chief federal prosecutor said it would review the documents.
"We're looking at it very carefully," a spokesman for the federal prosecutor's office said. "We will initiate an investigation if we see evidence of concrete criminal acts or specific perpetrators."