It is good to know that ISP have legal boundaries for retaining a client's internet activity. Is it possible that individuals can hack the ISP and then have access to someone's web history activity?
It's a simple question and the answer is even simpler. Yes (but for only half the reasons stated in the comment by KnightOfNi)
(Carrying on for the sake of completeness)
An 'airgap firewall' loosely describes a system not connected to anything else (taken here to also mean no wireless connections). Somehow data is input into the airgapped system and exported from it. Hack that mechanism and you can hack the airgapped system even if it's not connected to the internet.
If a tiny little PLC in a nuclear facility in the desert can be hacked, an ISP (which may or may not have carried a payload used in the attack if the attacker used that ISP) can definitely be hacked.
In fact, if you have physical access to a system, it doesn't even need to be on to be compromised.
If one man made, another man can break it.