For your ISP these data aren´t a secret since he notifies them to you. But what does “ISP” mean ? Is it a set of trusted employees or a galaxy of external suppliers out of control ?
I came to these questions when I was reached by phone for a broadband offer. The commercial do his speech and at one moment he starts to check my identity asking to me if my ID and my password are really mine ! Of course this offer come from my ISP, so I should not be surprised. But I´m not sure that my ISP performs his marketing offer in his wall, or whether he has delegated the task to some external call center. I think that the latter is most likely true.
The real point here is that requiring credentials for an identity checking isn´t necessary.