cache files compromised?

Hi, I got an email from DreamHost saying my website may have been hacked and the email identified these files:

We have identified malicious content on your account, added by an outside entity, which may include malware such as backdoor shells, adware, botnet, and spammer scripts.

The following file(s) specifically have been identified as attacker-added malware. We have DISABLED these files by setting their permissions to 200 (Owner write-only). You will need to audit these files and either replace them with known good versions or remove them altogether:

/home/user-name/website.com/wp-content/nfwlog/cache/backup_1624227373_60cfbe2d1897c2.12561092.php
/home/user-name/website.com/wp-content/nfwlog/cache/backup_1624324452_60d13964650843.54672699.php

I deleted the files and went through the usual security checklist, but I was hoping you could tell me how this may have happened, or if I need to change settings so it does not happen again?

Thank you