in my server (Debian) I have a copy of this file
/etc/passwd /etc/passwd- /etc/shadow /etc/shadow- /etc/group /etc/group-
why?
The files with the dash (-) at the end are backups. I would diff the files and see what changed. Investigate from there.