An email address can appear in a breach notice, an unwanted mailing list or a suspicious message. If you used a separate alias for that service, you have a useful starting point: you know where you intended to share it. Your next task is to understand what happened without cutting off your own account access.
Treat the address, the service account and your email access as three separate things. Replacing an address may reduce unwanted contact. It does not automatically secure a compromised account or undo the disclosure of other information.
Establish what you actually know
Start with the source of the warning. An unexpected message claiming that your account is at risk can itself be a phishing attempt. Open the company's website using a saved bookmark or an address you already know, then look for its notice or contact support through that site. The FTC recommends using independently known contact details when checking a suspicious message. FTC phishing guidance.
Keep a short private record: which alias was affected, which account uses it, what the company says was exposed and what you have already changed. Do not save live reset links or verification codes in a shared incident note.
If the only evidence is an unrelated advertisement, describe it that way. A unique alias narrows the possible paths, but does not prove the service was hacked or sold your information. Look for corroboration before drawing that conclusion.
Separate address exposure from credential exposure
Read the company's notice for the kinds of data involved. An exposed address creates a different problem from an exposed password, payment information or identity document. Follow the response appropriate to those data rather than treating an alias change as a universal fix.
If a password was exposed, replace it on that service and on any other account where you reused it or a similar one. Enable an additional authentication factor where the service supports it. The FTC's breach guidance covers these actions and stresses checking which information was disclosed. FTC guidance after a data breach.
If you entered credentials into a suspicious page, address that immediately even if no company has confirmed a breach. An alias cannot protect a password you give to the wrong site. Check the service's security settings for available session and recovery controls, and use its official recovery process if you cannot sign in.
Replace the address before disabling it
If you still need the account, create a replacement alias for that service. Change the address from inside the signed-in account. Complete any confirmation steps while the old address can still receive mail: the service may need to contact both addresses.
Then verify the actual outcome. Check the saved account email, notification settings and recovery address. A completed form is not enough if the website is still waiting for confirmation. Record the new address with the existing login details so you do not accidentally create a second account later.
Keep the old alias available while an unresolved change or support request depends on it. Once the replacement works and you have reviewed the remaining dependencies, disable reception on the old alias if you no longer need it.
Understand what disabling changes
Disabling an AliasX alias changes reception at that address. It does not remove the address from a company's database, erase previously received messages or close the associated service account. Do not interpret it as a request to cancel an order, subscription or contract.
It also cannot make a leaked address secret again. Someone who already knows it still knows it. The practical benefit is control over that incoming route, rather than the ability to reverse the disclosure.
AliasX is for incoming mail: sending, replies and reverse aliases are not available. If the company asks for an email reply from the affected address, use an authenticated support channel and ask what other proof it accepts. Avoid sending from your main mailbox without considering whether you want that address linked to the case.
Watch the account, not just the inbox
A quieter alias does not tell you whether the service account is safe. Review whatever account activity and security notices the service makes available. Be cautious about a new “support” message that includes accurate details from the original incident; familiar information is not proof that the sender is legitimate.
Before finishing, confirm four things: you can sign in, the account has the intended contact address, recovery remains usable, and any exposed credentials have been addressed. The alias gives you a manageable boundary. The service's own security and recovery steps complete the response.