Lifted it off a glass/phone/anything else you touched. Or it can be "compromised" in the same way your SSN can be compromised through hacking. The millions of people who were exposed in the OPM hack all have records of their fingerprints now floating out on the darkweb somewhere.

It could also be someone lifting it off through software on your phone if you had a device with a terrible implementation for handling fingerprints. See this piece about the HTC One Max from two years ago - the fingerprint was stored as a bitmap image in a "world readable" folder and refreshed with the image from the latest touch!

[1]: http://www.theregister.co.uk/2015/08/10/htc_caught_storing_f...

Someone

1) lifted it off some surface. 2) got the right fingerprint when they did it 3) modeled a fake fingerprint well enough that it would fool touchID 4) Was able to get access to your touchID device while you weren't aware or unable to stop them

Most experts recommend that you instead use a pin-code of at least 6 numbers, or a password of at least 12 random characters using at least one number, and at one punctuation mark. In that case the attacker's algorithm changes to

1) Check for posted note containing password on computer monitor, or 2) Check purse or wallet for posted note containing passcode

A badly-written program that stores the fingerprint data in a reversible/plaintext manner. Once their database gets pwned (and/or is left wide open on the cloud) your biometrics can be reconstructed and used to authenticate as you.