The Islamic State group has claimed the attacks, which killed at least 13 people on Sunday.
A mother and two daughters blew themselves up at a church, while the father and two sons targeted two others in Indonesia's second city, Surabaya.
National police chief Tito Karnavian said they belonged to an IS-inspired network, Jemaah Ansharut Daulah (JAD).
Police say the family were among hundreds of Indonesians who had returned from Syria, where IS has been fighting government forces. No details were given about the family's alleged involvement in that conflict.
The bombings are the deadliest in Indonesia in more than a decade, and also left more than 40 people injured.
Visiting the scene of one of the attacks, President Joko Widodo described them as "barbaric", adding that he had ordered police to "look into and break up networks of perpetrators".
How did the family stage the attack?
Police identified the father as Dita Futrianto, saying he was the head of a local JAD cell.
He reportedly dropped off his wife, Puji Kuswati, and their two daughters at Diponegoro Indonesian Christian Church, where they blew themselves up. The girls - aged 9 and 12 - had bombs strapped to them, as did their mother.
Futrianto then drove off, launching his own bomb-laden car into the grounds of Surabaya Centre Pentecostal Church, police said.
The sons - aged 16 and 18 - rode motorcycles into Santa Maria Catholic Church, and detonated explosives they were carrying. It was their attack that came first, at around 07:30 local time (00:30 GMT). The other two attacks followed five minutes apart, police said.
A security guard told the Associated Press news agency that the woman had arrived at the Diponegoro church carrying two bags, and forced her way inside ignoring the guards.
"Suddenly, she hugged a civilian, then [the bomb] exploded," said the eyewitness, who identified himself as Antonius.
What happened next?
East Java's police chief, Mahfud Arifin, said that those killed at the apartment were the perpetrators, not victims.
It is not yet known if this bombing was connected to the other attacks.
Officials reportedly foiled attacks against other churches too.
Also on Sunday, police said they killed four suspected members of JAD in Cianjur, in West Java province, and arrested two others.
How does this compare to previous attacks?
This appears to be the worst attack linked to IS in Indonesia. The group claimed its first attack in the country in 2016, when four civilians were killed in explosions and shootings in the capital Jakarta.
It has also claimed other attacks, including one in a high-security prison near Jakarta which killed five members of security forces earlier this month.
But the country's deadliest jihadist attacks predate IS.
In 2002, over 200 people were killed in two bombings carried out by al-Qaeda-linked militants on the island of Bali, a popular tourist destination.
In May 2005, bomb blasts killed 22 on the island of Sulawesi. Less than six months later, a suicide bombing in Bali killed 20.
The BBC's Rebecca Henschke in Jakarta says Indonesia had been widely praised for its anti-terrorism crackdown since then, but the rise of IS overseas has invigorated the country's loosely constituted jihadi networks.