Yes, though the outcome is fact-intensive and may—like much of tort law—vary from state to state. The general rule—provided for in the Restatement of Torts (Second)—is that businesses can be liable for third-party criminal attacks that are reasonably foreseeable if the business owner takes little or no security precautions.

For example, let’s say that a shopping mall experiences a rash of crime, including robberies and assaults of its patrons. The mall fails to provide increased lighting or for an extra security guard to patrol the mall parking lots. A jury may find that the mall owner’s refusal to provide increased security measures crosses the line into negligent behavior, particularly when the mall owner knew about the prior incidents of crime.

However, the shopping mall owner will contend that the criminal act of the third party was a superseding, intervening cause that broke the chain of causation. This may be a difficult argument for the mall owner to advance if it can be established that the mall owner knew of existing crime on the premises.

The answer also could depend on whether a court finds that there is a special relationship to protect patrons or customers. The California Supreme Court ruled that there was a special relationship and potential premise liability when a patron warned a bouncer about impending trouble from people in and near the bar. The patron was later beaten severely right outside the bar. On that set of facts, the California high court found there was a duty of care owed to the patron and that it was reasonably foreseeable that this attack could happen.