Happened to me too. Twice. First time all user_login names were changed to “admin”, second time all were changed to “jar”
After the first time, I paid a security expert to thoroughly review my entire server contents and he said he found a bunch of malware, hidden shell scripts or something like that. A few days after that the second event happened, all user_login names changed to “jar”.
I don’t know what to do.