Which account do you think was "breached:" Cox or Yahoo? I thought it was Cox. Does Cox require an alternate address? I know Yahoo does.
If I have a Cox email account and the only warning from Cox is sent to another email account, I'd think something was phishy.
I'd log into my Cox account via bookmark not via provided link...if provided...and if there is no other warnings within my Cox account, it'd confirm something was phishy.
If Cox wanted me to change my password, Cox would have forced me to change my password on their login page while I was confirming potential phishiness.