Okay, it remains a mystery then. At least easy to recognize and it does not really break anything aside of login banner and aliases in the interactive shell. We will see whether there are more reports like this, to have another look into how it could have happened.