My husband and I decided to have a web developer in the US add a shopping cart recently to our business site, and decided not to go with the guy we worked with in Mexico. He is not owned anything and the reason we didn't go with him is b/c his fees were higher than expected and didn't understand what he was basing his fees on for installing a shopping cart. After we comunicated our decision, he has changed passwords on us and has said that the website is his and not ours. We didn't have a written contract but we paid him for a couple of years of hosting, and setting up the original website without a shopping cart. This individual in Mexico is an English man, whom my husband was able to contract and we thought he would have business ethics. Not sure if we have a leg to stand since his business is in Mexico and works as a contractor.

If you were paying him for hosting as well as development, then he's holding the cards.

If the domain name is registered under a different company (highly recommended) then one alternative is to just point the domain name to a different web host and upload your files (or duplicate as best as you can).

If he's got the domain name as well, then if the domain name is your business's registered trademark and/or trade name, then you can send a cease-and-desist letter to both him and the comany providing the domain registration service, which you can track down using WHOIS...