I suspect this is how it could have happened in your case - a few weeks ago, or even months ago, you used that card to make a purchase over the internet, or by phone.
To do this you would have given at least your full name, address, card number, expiry date and security number on the back.
That information has been used either by an employee of that company, or sold by an employee.
That is enough information for a crook to use your card by phone or internet.
The card I use mostly online is Tesco. Before the transaction goes through, I get a pop up window from Tesco asking me for certain letters from a predefined password. If I can't give those three letters, the transaction is refused. There is no way the retailer can access any part of this security process, so it does go some way to preventing fraud.
Another card provider has issued me with a swipe reader. I pass the card through that for a generated number that must be used in a pop up - a similar method to Tesco.
I shall cease using the cards that have no such measures in place for absent transactions, I think.