Hypothetical: Security Intrusion
Simply "disable" the login:  

ALTER LOGIN [xyz] DISABLE;


Then, if the login is a SQL Server login, you can change the password with:

ALTER LOGIN [xyz] WITH PASSWORD = '$ome$ecurePa$$w0rd';


Then, re-enable the login:

ALTER LOGIN [xyz] ENABLE;


If the login is from Active Directory, you can still disable the account (and re-enable later), but you'll need to have the password changed in Active Directory.

Note that disabling the login does not disconnect anyone currently connected as that login. In order to do that, you'd need to kill the spids associated with the login.