
    L.A.C., a minor, by and through her Next Friend, D.C., Appellant, v. WARD PARKWAY SHOPPING CENTER COMPANY, L.P., et al., Respondents.
    No. SC 83718.
    Supreme Court of Missouri, En Banc.
    May 28, 2002.
    
      Scott A. McCreight, Michael S. Ketch-mark, Joseph K. Eischens, Kansas City, for Appellant.
    Paul P. Hasty, Jr., Rebecca S. McGinley, David Curotto, Douglas R. Richmond Thpmas B. Weaver, Jeffrey T. McPherson, Casey 0. Housley, Kansas City, for Respondents.
   WILLIAM RAY PRICE, JR., Judge.

I.

Summary

L.A.C., a minor, claims that she was raped at the Ward Parkway Shopping Mall. She brought suit against the owners, operators and managers of the mall and the security company hired by them to provide security services for the mall. The trial court granted summary judgment for the defendants, finding that they had no duty to protect plaintiff from the criminal acts of a third party.

We reverse, because: 1) this type of criminal action was foreseeable so that the owners and managers of the mall had a duty to take reasonable care to protect business invitees; 2) the contract between the owners and managers of the mall and the security company clearly and directly provided for the safety of the mail’s business invitees and, as a third party creditor beneficiary, plaintiff can bring suit against the security company for breach of that contract; and 3) the security company had a duty to plaintiff and the other business invitees of the mall to exercise reasonable care in the provision of its security services.

II.

Factual and Procedural Background

A.

The facts in this case are greatly contested. We are bound to review the record in the fight most favorable to the party against whom summary judgment was entered. City of Hazelwood v. Peterson, 48 S.W.3d 36, 38-39 (Mo. banc 2001). Viewing the evidence most favorable to plaintiff, the facts are as follows.

On March 15, 1997, L.A.C., a twelve-year old minor, went to Ward Parkway Shopping Center to see a movie with her friend, A.G. After leaving the movie, she and a group of friends gathered in a common area. Also with the group was a fifteen-year old boy, whom plaintiff had met the previous weekend.

While she- talked to this young man, he grabbed her purse and ran off with it into á hallway. She followed, demanding its return. The young man replied, “No, not till you give me a kiss.” She complied, and the young man returned her purse. But as she turned to walk away, the young man grabbed her, and said, “Let’s do it.”

The young man picked her up and began to carry her. Plaintiff screamed, hitting him on the back and demanding to be put down. Friends nearby refused to help her because the boy was older and bigger and had a gun showing. The young man briefly put her down, but then said, “[W]e’re going to do this,” picked her up and carried her into the “catwalk,” a walkway connecting the mall to a parking lot. In the catwalk, despite her struggles, the young man raped her.

After the plaintiff was picked up and began screaming, her friend went downstairs and within a minute found an IPC security guard. She told the guard that her friend was in trouble and needed help. The guard dismissed her, saying that the young man was just playing. A.G. then went upstairs and found another IPC officer near the arcade. After explaining what happened, that officer also dismissed her, accusing her of trying to “get some boys for messing with [the girls].”

After her second failed attempt to get help, A.G. saw L.A.C. again. At first, in a state of shock and warned by her assailant to be silent, plaintiff said nothing. However, after a couple of minutes, she broke down and cried, telling her friend that the young man had raped her. Plaintiff reported the rape to the police and received treatment that night at a hospital. Her assailant was arrested the next day and eventually found to have committed rape by the juvenile division of the circuit court.

B.

Ward Parkway Shopping Center Company, L.P. (WPSCC) and W.S.C. Associates, L.P. (WSC) both own and operate the Ward Parkway Shopping Center (the mall), and G.G. Management (GG) provides management services at the mall pursuant to a management agreement (these parties will be referred to collectively as the Ward Parkway Group). IPC International Corporation (IPC) is a security company with whom GG contracted to provide security for the mall.

The contract between the mall management and IPC contains a number of relevant provisions. Two are especially important. First, IPC security officers are empowered to detain individuals when necessary to protect mall customers from risk of serious injury:

I. 3. H. Under normal circumstances, an employee or agent of the CONTRACTOR, shall avoid making an arrest of any kind; provided, however, the employees or agents of the CONTRACTOR may detain an individual when necessary to protect either that individual or mall customers or employees from risk of serious injury, [emphasis supplied]

Second, IPC and mall management both agreed to cooperate to determine the proper work hours and staffing to “provide adequate security to the mall.”

I. 4. HOURS & STAFFING — The daily and weekly schedule of security man-hours and coverage at each location shall be determined by the Manager, subject to input from CONTRACTOR. The hours and number of Security Officers required will change periodically. The Manager has the right to change hours and personnel coverage.
VI. 5. Manager and Contractor shall agree upon the proper level of staffing needed to provide adequate security to Mall [sic]. Upon agreement, the staffing level shall be conclusively deemed for all purposes to be a material representation by Contractor to Manager that the staffing level is one which will provide full and adequate security to the Mall. CONTRACTOR will be able to provide additional security staff for grand opening events on an “as needed” basis. Officers will be in uniform, and ready for duty at the start of their assigned shifts, [emphasis supplied]

The contract also assigns specific duties to IPC security officers, including making frequent, random rounds of the premises to check for safety hazards. Security officers are required to be watchful for criminal activities and report any such observations to mall management:

I. 3. B. Report immediately to representatives designated by the Manager any unusual incidents, hazardous conditions, accidents, defects, suspicious activities, or criminal activities observed during the shift.
C. Prepare for the Manager at the end of each shift, a security log report noting therein all incidents, accidents, suspicious activities, hazardous conditions or criminal -activities observed. Unless other provisions are made by the parties, all reports shall be prepared on standard log- forms, provided by the Manager.
D. Perform such other duties and enforce rules and regulations as are mutually agreed upon by the parties that are reduced to writing, and that are made available to the Security Officers assigned to each location by representatives of the Manager.

IPC agreed to bind its employees to a Policy and Procedures Manual published by IPC:

I. 3. J. Manager has adopted a comprehensive Security Orders Policy and Procedures Manual (herein “the manual”.) The manual includes Manager’s instructions to CONTRACTOR and a copy of Manager’s Safety Regulations. CONTRACTOR and its employees shall be familiar with and will adhere to those instructions and regulations at all times. CONTRACTOR shall disseminate such manual to all Security Officers and shall insure that said Security Officers comply with the content thereof.

IPC agreed to be familiar with and adhere to these instructions and regulations at all times. Two passages from the manual expressly indicate:

The ultimate goal of any successful shopping center Owner, Developer or Manager is the continued patronage of customers to the mall. In each Center, Mall Management endeavors to create a safe, orderly atmosphere in which customers may relax and shop without undue concern for their own safety. In order to sustain and insure this positive atmosphere, the management of your Center has retained the services of IPC International Corporation to provide Mall Public Safety Services.
You have been chosen to be a member of the Public Safety Staff by individuals who feel that you have the potential to be a true asset to the organization-one who has the right combination of knowledge, experience, education, judgment and positive appearance to understand and perform the varied responsibilities of an IPC Mall Public Safety Officer. Given the proper “tools” of knowledge which follow in this manual, you will have everything that you need to perform your duties in an effective and professional manner. It is up to you to earn the respect and confidence of those for whom and with whom you work.

Finally, IPC also distributed a training manual to its employees, which stated:

The personal safety of yourself, fellow Officers, customers and tenants to the mall is the absolute priority at all times
Our clients are most concerned with the well being of visitors, customers and employees of the shopping center. It is for this reason that Public Safety personnel are present.
[T]he responsibility for the safety of life and property within the center is shared by tenant stores, civil authorities, center management (through the Public Safety Service) and each individual person who visits the center.

C.

Plaintiff brought suit against all parties for ordinary negligence. She also sued GG and IPC for breach of contract as a third party beneficiary of the management and security contracts. After discovery, Ward Parkway Group moved for summary judgment and IPC moved for judgment on the pleadings. In support of its response to the motions, plaintiff submitted evidence that the mall management was put on notice of criminal activity at the mall, consisting of IPC incident reports and Kansas City police department records. The IPC records are detailed reports of incidents involving criminal activity that occurred at the mall. Some of the submitted police records correlate with some of the IPC reports. Others that plaintiff submitted in addition to the IPC reports are not detañed, merely fisting a crime that allegedly happened at the mall.

The IPC incident reports describe a number of crimes, violent and non-violent, that were reportedly perpetrated on the premises of the Ward Parkway mall within the three years prior to the incident. The reports include one sexual assault, one robbery and abduction, thirteen armed or attempted armed robberies, nine strong-arm or otherwise violent robberies, four aggravated assaults and twenty-eight simple assaults. The IPC reports also include nine incidents labeled “battery,” which range from an improper touching, to a fight, to an assault during an attempted theft of an automobfie. Three reports indicate unlawful use of a firearm, including one involving a suspect who pointed a weapon at officers after a robbery. (A large number of the proffered IPC reports indicate non-violent crimes, such as one instance of sexual misconduct and numerous instances of disorderly conduct, stalk-mg and public indecency.) In all, at least seventy-five of the crimes were violent, including the following:

03/13/97 An offender, while stealing her purse, pushed a woman down. She required __hospitalization._
03/07/97 In the parking lot, a man attempted to rob a van. He entered the vehicle and _pulled a knife on a young woman in the car._
02/26/97 Two men committed armed vehicular robbery against a woman, taking her car __keys at gunpoint._
01/15/97 Two women had their purses stolen at gunpoint in the parking lot._
12/02/96 After a bartender attempted to wake up a man who had fallen asleep at a mall restaurant, the man attacked him with a knife. He also assaulted a security _officer who had attempted to intercede._
12/01/96 A man approached a woman in the parking lot and threatened to “do her” before _running off,_
11/23/96 A young man was robbed at gunpoint in the parking lot._
08/30/96 With a gun, a man in the parking lot forced a female mall employee to give her _keys to him and stole her car._
07/26/96 A man approached two female mall employees in the parking lot and robbed one _of them of her purse at gunpoint._
06/01/96 An employee of a mall restaurant held the store manager at knife point, forcing _her to open the safe and then abducting her._
05/29/96 A man pushed his girlfriend out of a moving car in the parking lot._
04/15/96 A report was made by a mall restaurant employee of a sexual assault by a fellow _employee in the mall bathroom._
12/01/95 During a robbery in the parking lot, a woman was dragged a short distance by the offender as he grabbed her purse. She suffered injuries, including a cut _that required stitches._
09/29/95 A teenager was molested by a stranger in the mall movie theater._
08/16/95 A mother and daughter were robbed at gunpoint in the parking lot._
08/11/95 A woman entering the mall was assaulted by three women, who kicked and _punched her._
06/12/95 A mall employee was robbed in the mall of his wallet at knifepoint.

Many of these crimes, especially some of the most violent, involved female victims. In 1996, a female store manager was abducted and the victim of an armed robbery. Just a few months prior to the incident in this case, a mother and daughter were both robbed at gunpoint in the parking lot. At least three other armed robberies involved female victims and male offenders, as well as virtually every reported strong-armed robbery. Women were also victims of a number of assaults and violent purse snatchings. A statistical analysis of crimes at the shopping center prepared by IPC indicates that a disproportionate number of victims of crime at the mall were women. For example, in 1994, 28.7% of the victims were female adults, compared to only 18.2% male adults. In the first quarter of 1996, 50% of the victims were female and only 21.3% male. In the first quarter of 1997, however, an even percentage of men and women were victims in incidents at the mall.

In addition to the incident reports detailing criminal activity that occurred on the premises of the shopping center, plaintiff submitted deposition testimony of various corporate officers of GG and IPC. The corporate security director for GG testified as follows:

Q: My question, sir, is whether or not you were aware of the potential risk of a sexual assault occurring at Ward Parkway Mall?
A: I was aware that it was possible for it to occur, yes.
Q: Do you believe that Ward Parkway Mall has a duty to protect its customers from criminal activity?
A: I believe the owner of the property has a duty, yes.
Q: And that duty would apply to the type of crimes we’re talking about-assault, sexual assault, rape — correct?
A: Correct.
[objections omitted]

An executive vice president of IPC answered affirmatively that rape in isolated areas of a mall is a security concern of thé company and that rape is “a crime that we are constantly vigilant for in all areas of the shopping center.”

A 1995 security audit conducted for the mall management by IPC that indicated the catwalk area was frequented by “unruly youth” and had been the site of a “high level of incidents.” The audit identified a number of security issues that IPC suggested should be implemented to improve safety at the shopping center. These proposals included enhancing the lighting in the catwalk area and conducting an evaluation to determine if an additional security officer should be deployed on Friday and Saturday evenings. The audit noted that the lights along the base of the wall of the theater exits, near the catwalk, were not illuminated.

The trial court granted the Ward Parkway Group’s motion for summary judgment and IPC’s motion for judgment on the pleadings on all claims. In granting judgment for IPC, the trial court considered depositions, affidavits, documents and other evidence outside of the pleadings. We, therefore, review the grant of the motion for dismissal on the pleadings as a grant of a motion for summary judgment.

Plaintiff appeals the judgment against her on her negligence claims against all parties. She also appeals the judgment against her on her contract claims against IPC. Plaintiff does not appeal the judgment on her contract claim against GG.

III.

Analysis

The propriety of summary judgment is an issue of law, and appellate review is de novo. City of Hazelwood v. Peterson, 48 S.W.Sd 36, 38-39 (Mo. banc 2001). Summary judgment is proper when no genuine issue of material fact exists and the moving party is entitled to judgment as a matter of law. Id. The burden is on the moving party to demonstrate that there are no genuine issues of material fact. ITT Commercial Fin. Corp. v. Mid-America Marine Supply Corp., 854 S.W.2d 371, 380 (Mo. banc 1993). Where the record contains competent materials establishing two plausible but contradictory accounts of the essential facts, a “genuine issue” of material fact exists. Martin v. City of Washington, 848 S.W.2d 487, 492 (Mo. banc. 1993); Montgomery v. S. County Radiologists, 49 S.W.3d 191, 193 (Mo. banc 2001).

A.

Claims Against Ward Parkway Group Defendants

Plaintiff asserts traditional negligence claims against the Ward Parkway Group defendants. Ward Parkway Group obtained judgment in the trial court on the basis 'that the criminal acts committed against plaintiff were not foreseeable and defendants accordingly had no duty to plaintiff.

Plaintiff alleges that numerous violent crimes committed on the premises of the mall in the previous three years, as well as other evidence of foreseeability, indicate that crimes such as rape were foreseeable. She argues that Ward Parkway Group owed business invitees, such as herself, a duty to take reasonable measures to protect them from criminal acts occurring on the premises by unknown third parties.

i.

Different states have devised at least four methods to frame the issue of business owners’ liability in tort for criminal acts of unknown third persons. The most stringent method, “the specific harm” test, requires notice of specific dangers just pri- or to the assault. Bums v. Johnson, 250 Ya. 41, 458 S.E.2d 448 (1995). A second method, the “prior similar incidents” rule, was the first to gain widespread support. Under that approach, duty is only found if plaintiff can prove that defendant had notice of a sufficient number of prior acts of similar violent crime occurring on the premises. Lauersdorf v. Supermarket Gen. Corp., 239 A.D.2d 319, 657 N.Y.S.2d 732 (N.Y.App.Div.1997). In recent years, the “prior similar incidents” test has given way to the less rigid “balancing test” approach, Ann M. v. Pacific Plaza Shopping Center, 6 Cal.4th 666, 25 Cal.Rptr.2d 137, 863 P.2d 207 (1993); McClung v. Delta Square Limited Partnership, 937 S.W.2d 891 (Tenn.1996), or the “totality of the circumstances” test. Seibert v. Vic Regnier Builders, Inc., 253 Kan. 540, 856 P.2d 1332 (1993); Galloway v. Bankers Trust Co., 420 N.W.2d 437 (Iowa 1988). See generally 31 A.L.R.5& 550; Prem Liab 2d s. 49:3; 57 Wash & Lee L.Rev. 611, 617, n. 42(2000).

Missouri set out its approach almost fifteen years ago in Madden v. C & K Barbecue Carryout, Inc., 758 S.W.2d 59 (Mo. banc 1988). Madden consisted of two consolidated cases: Madden and Decker v. Gramex Corporation. The plaintiff in Madden was kidnapped from the parking lot of a restaurant and later sexually assaulted. 758 S.W.2d at 60. The restaurant was found to have a duty to protect its business invitees, because over the three-year period preceding the assault, numerous crimes were committed on the premises. Id. These crimes included six armed robberies, six strong-arm robberies, one assault and one purse snatching. Id. Decker involved the abduction and murder of two customers. 758 S.W.2d at 61. A slightly lower level of criminal activity on the premises of a grocery store also established a duty of care to protect business invitees. Id. The plaintiffs in Decker submitted evidence of four armed robberies, assault, assault with a deadly weapon and flourishing a deadly weapon. Id. In Madden, the Court did not find it necessary to adopt any special test or method to analyze the issue. Instead, it merely followed traditional principles of the law of negligence.

Tort law focuses on three basic elements: duty, breach and damages. Accordingly, “[i]n any action for negligence, the plaintiff must establish that the defendant had a duty to protect the plaintiff from injury, the defendant failed to perform that duty, and the defendant’s failure proximately caused injury to the plaintiff.” Lopez v. Three Rivers Electric Cooperative, Inc., 26 S.W.3d 151, 155 (Mo. banc 2000).

“Whether a duty exists is purely a question of law.” Lopez, 26 S.W.3d at 155. “The touchstone for the creation of a duty is foreseeability.” Madden, 758 S.W.2d at 62 (Mo. banc 1988). “A duty of care arises out of circumstances in which there is a foreseeable likelihood that particular acts or omissions will cause harm or injury.” Id. (citations omitted). “Where the existence of a duty is established, however, it is not one to protect against every possible injury which might occur.” Hoover’s Dairy, Inc. v. Mid-America Dairymen, Inc., 700 S.W.2d 426, 431 (Mo. banc 1985) (citations omitted). “Rather, it is generally measured by whether or not a reasonably prudent person would have anticipated danger and provided against it.” Id.

A duty to protect against the criminal acts of third parties is generally not recognized because such activities are rarely foreseeable. “Generally, there is no duty to protect business invitees from the criminal acts of unknown third persons.” Madden, 758 S.W.2d at 62. However, in situations where a special relationship exists, such as that between a business owner and invitee, and injury is foreseeable to recognizable third parties, a duty will be imposed. Hence, “a duty to exercise care [to protect business invitees] may be imposed by common law under the facts and circumstances of a given case.” Madden, 758 S.W.2d at 62.

There are two “special facts and circumstances” exceptions to the rule that businesses generally have no duty to protect invitees from criminal acts of third persons. Faheen v. City Parking Corp., 734 S.W.2d 270, 272-73 (Mo.App.1987). Under the first exception, “the duty may arise when a person, known to be violent, is present on the premises or an individual is present who has conducted himself so as to indicate danger and sufficient time exists to prevent injury.” Id. The other exception recognizes “a duty [on the part of business owners] to protect their invitees from the criminal attacks of unknown third persons” under certain special circumstances. Madden, 758 S.W.2d at 62. “A duty of care arises out of circumstances in which there is a foreseeable likelihood that particular acts or omissions will cause harm or injury.” Id. at 62.

It is the second exception that is primarily at issue here. There is no evidence in the record to establish that defendants knew the assailant to be a violent individual or a particular threat to the safety of other persons prior to this incident. Thus, in order to establish duty, plaintiff must show evidence that would cause a reasonable person to anticipate danger and take precautionary actions to protect its business invitees against the criminal activities of unknown third parties. Madden, 758 S.W.2d at 62. Specifically, “plaintiff need not show that the very injury resulting from defendant’s negligence was foreseeable, but merely that a reasonable person could have forel seen that injuries of the type suffered would be likely to occur under the circumstances.” Smith v. Archbishop of St. Louis, 632 S.W.2d 516, 521 (Mo.App.1982). Violent crimes are foreseeable if the premises have been the site of other prior violent crimes, including robbery, assault, burglary, stealing, arson, abduction, murder, sexual assault and rape. Madden, 758 S.W.2d at 62, n. 2.

A number of subsequent commentators and Missouri courts have attempted to categorize the Madden decision, to mixed results, concerning the precise requirements of the second exception. Wood v. Centermark Properties, Inc., 984 S.W.2d 517, 523 (Mo.App.1998) (prior specific incidents); Becker v. Diamond Parking, Inc., 768 S.W.2d 169, 170-71 (Mo.App.1989) (totality of the circumstances); Hunter M. Bagby, Recent Development: Premises Liability, 23 Am. J. Trial Advoc. 461, 464 (1999) (balancing test, citing Aaron v. Havens, 758 S.W.2d 446 (Mo. banc 1988)); See also William M. Corrigan, Jr. & Timothy W. Van Ronzelen, Liability for Criminal Acts of Third Parties, 52 J. Mo. B. 359 (1996). But see Timothy A. Reuschel, Here’s Your Burrito and Watch Your Back: Does Missouri Really Want to Hold Businesses Liable for Attacks on Patrons?, 65 Mo. L.Rev. 255, 258 (2000) (“In Madden, the court did not explicitly adopt the ‘totality of the circumstances’ test or the ‘prior similar incidents’ test for foreseeability.”) Although Madden considered prior similar incidents, it used language implying a totality of the circumstances test (“the facts and circumstances of a given case”) Madden, 758 S.W.2d at 62. As will be discussed below, this case does not require that we enter the fray concerning whether a “prior similar incidents,” “totality of the circumstances” or a “balancing” test be adopted because the evidence set forth by plaintiff would satisfy any of the three. Moreover, it may well be that adoption of any of these approaches is less helpful than simply utilizing traditional tort language as was done in Madden. A traditional tort approach recognizes that both duty and breach adapt to the precise situation of the case, and that duty does not imply strict liability or even breach.

ii.

IPC reports indicate that seventy-five violent crimes occurred on mall property in the three years preceding the attack on plaintiff. Of these, sixty-two percent of the crimes with identifiable victims involved solely female victims. As detailed above, included in this number are some of the most violent, including abduction, sexual assault and a number of violent, armed and strong-arm robberies. Defendants attempt to argue that a number of these crimes occurred outside of the mall in the parking lot or did not include common elements with plaintiffs rape, and were therefore not similar. Defendants’ analysis in this regard is too restrictive.

Foreseeability does not require identical crimes in identical locations. Violent crimes against women, particularly, serve sufficient notice to reasonable individuals that other violent crimes, including sexual assault or rape of women, may occur. Defendants argue that incidents involving “escaping suspects, verbal and physical altercations, robbery and indecent acts” are not sufficiently similar to the rape that is alleged to have occurred here. This is not realistic. These are precisely the type of criminal acts that would put reasonable and prudent people on notice that precautions should be taken, as is evidenced by the testimony of GG’s corporate security director that:

Q: My question, sir, is whether or not you were aware of the potential risk of a sexual assault occurring at Ward Parkway Mall?
A: I was aware that it was possible for it to occur, yes.
Q: Do you believe that Ward Parkway Mall has a duty to protect its customers from criminal activity?
A: I believe the owner of the property has a duty, yes.
Q: And that duty would apply to the type of crimes we’re talking about — assault, sexual assault, rape-correct?
A: Correct.
[objections omitted];

and IPC’s executive vice president who answered affirmatively that rape in isolated areas of a mall is a security concern of the company and that rape is “a crime that we are constantly vigilant for in all areas of the shopping center;” and the conclusions of IPC’s security audit that indicated that the crime scene was frequented by “unruly youth” and had been the site of a “high level of incidents.” Although this testimony cannot be taken as a binding legal position on the part of defendants, it certainly can be considered as evidence of foreseeability.

The incident reports and the testimony of defendants’ employees clearly establish that they were aware of a significant number of violent crimes at the mall prior to this occurrence. Continued violent crime, such as the alleged rape of L.A.C. was foreseeable. Defendants had a duty to take reasonable measures to protect mall customers, and specifically L.A.C., from this type of violent criminal activity.

B.

Claims Against IPC

Plaintiff asserts two claims against IPC, breach of contract and negligence. IPC obtained judgment in the trial court on the basis that it had no obligation to plaintiff under the contract and no duty to plaintiff in tort. Although the analysis as to each claim is similar, each claim arises under different areas of law, and each claim must be considered separately.

i.

Contract Claims Against IPC

Plaintiff, of course, is not a signatory party to the IPC contract. The validity of her claim rests up whether she can make her claim as a third party beneficiary. “A third party beneficiary is one who is not privy to a contract or its consideration but who may nonetheless maintain a cause of action for breach of the contract.” Andes v. Albano, 853 S.W.2d 936, 942 (Mo. banc 1993). “Only those third parties for whose primary benefit the parties contract may maintain an action.” Id. “[I]t is not necessary for the parties to the contract to have as their ‘primary object’ the goal of benefiting the third parties, but only that the third parties be primary beneficiaries.” Id.

“The intention of the parties is to be gleaned from the four corners of the contract, and if uncertain or ambiguous, from the circumstances surrounding its execution.” Tern Du Lac Ass’n. v. Teire Du Lac, Inc., 737 S.W.2d 206, 213 (Mo. App.1987). “Third party beneficiary rights depend on, and are measured by, the terms of the contract between the promisor and the promisee.” Id. “Although it is not necessary that the third party beneficiary be named in the contract, the terms of the contract must express directly and clearly an intent to benefit an identifiable person or class.” Id.

There are three types of third party beneficiaries: donee, creditor and incidental. The first two categories may recover, the third may not. Kansas City N.O. Nelson Co. v. Mid-Western Construction Co. of Missouri, Inc., 782 S.W.2d 672, 677 (Mo.App.1989). “A person is a donee beneficiary if the purpose of the promisee in obtaining the promise of all or part of the performance thereof is to make a gift to the beneficiary or to confer upon him a right against the promisor to some performance neither due nor supposed nor asserted to be due from the promisee to the beneficiary.” Id. “A person is a creditor beneficiary if the performance of the promise will satisfy an actual or supposed or asserted duty of the promisee to the beneficiary.” Id. “Finally, if the person is neither a donee beneficiary nor a creditor beneficiary, he is an incidental beneficiary.”

As previously indicated, the owners and the operators of the mall had a duty to take reasonable precautions to protect mall customers from violent crime. The Ward Parkway Group contracted with IPC for this very purpose. Brief review of certain provisions of the IPC contract make this clear.

First, IPC security officers are empowered to detain suspects when necessary to protect mall customers from risk of serious injury:

I. 3. H. Under normal circumstances, an employee or agent of the CONTRACTOR, shall avoid making an arrest of any kind; provided, however, the employees or agents of the CONTRACTOR may detain an individual when necessary to protect either that individual or mall customers or employees from risk of serious injury, [emphasis supplied]

Second, IPC and mall management both agreed to cooperate to determine the proper work hours and staffing to “provide adequate security to the mall.”

I. 4. Hours & Staffing — The daily and weekly schedule of security man-hours and coverage at each location shall be determined by the Manager, subject to input from CONTRACTOR. The hours and number of Security Officers required will change periodically. The Manager has the right to change hours and personnel coverage.
VI. 5. Manager and Contractor shall agree upon the proper level of staffing needed to provide adequate security to the mall. Upon agreement, the staffing level shall be conclusively deemed for all purposes to be a material representation by Contractor to Manager that the staffing level is one which will provide full and adequate security to Mall [sic]. CONTRACTOR will be able to provide additional security staff for grand opening events on an “as needed” basis. Officers will be in uniform, and ready for duty at the start of their assigned shifts, [emphasis supplied]

The contract also assigns specific duties to IPC security officers, including making frequent, random rounds of the premises to check for safety hazards. Security officers are required to be watchful for criminal activities and report any such observations to mall management:

I. 3. B. Report immediately to representatives designated by the Manager any unusual incidents, hazardous conditions, accidents, defects, suspicious activities, or criminal activities observed during the shift.
C. Prepare for the Manager at the end of each shift, a security log report noting therein all incidents, accidents, suspicious activities, hazardous conditions or criminal activities observed. Unless other provisions are made by the parties, all reports shall be prepared on standard log forms, provided by the Manager.
D. Perform such other duties and enforce rules and regulations as are mutually agreed upon by the parties that are reduced to writing, and that are made available to the Security Officers assigned to each location by representatives of the Manager.

IPC agreed to bind its employees to a policy and procedures manual published by IPC:

I. 3. J. Manager has adopted a comprehensive Security Orders Policy and Procedures Manual (herein “the manual”.) The manual includes Manager’s instructions to CONTRACTOR and a copy of Manager’s Safety Regulations. CONTRACTOR and its employees shall be familiar with and will adhere to those instructions and regulations at all times. CONTRACTOR shall disseminate such manual to all Security Officers and shall insure that said Security Officers comply with the content thereof.

The contract references the policy and procedures manual, published by IPC, which provides:

The ultimate goal of any successful shopping center Owner, Developer or Manager is the continued patronage of customers to the mall. In each Center, Mall Management endeavors to create a safe, orderly atmosphere in which customers may relax and shop without undue concern for their own safety. In order to sustain and insure this positive atmosphere, the management of your Center has retained the services of IPC International Corporation to provide Mall Public Safety Services.
You have been chosen to be a member of the Public Safety Staff by individuals who feel that you have the potential to be a true asset to the organization — one who has the right combination of knowledge, experience, education, judgment and positive appearance to understand and perform the varied responsibilities of an IPC Mall Public Safety Officer. Given the proper “tools” of knowledge which follow in this manual, you will have everything that you need to perform your duties in an effective and professional manner. It is up to you to earn the respect and confidence of those for whom and with whom you work.

There can be no doubt that the Ward Parkway Group contracted with IPC to assist it in its duty to take reasonable measures to protect mall customers from criminal activity. We especially note the language of the IPC contract, paragraph VI. 5, indicating that “Upon agreement, the staffing level shall be conclusively deemed for all purposes to be a material representation by Contractor to Manager that the staffing level is one which will provide full and adequate security to Mall [sic].” As such, plaintiff is a creditor beneficiary of the contract and has a right to bring suit and recover if she can also establish breach that caused damages.

ii.

Negligence Claim Against IPC

Although a contract may not generally be the source of a tort duty by one of the contract parties to a third party, Missouri law recognizes an exception in situations involving the safety of other persons. In Wolfmeyer v. Otis Elevator Co., 262 S.W.2d 18, 21 (Mo.1953), the Court stated:

The contract is of interest to us because it shows what defendant undertook to do. Some of the things defendant undertook to do were such as might affect the safety of third persons, including plaintiff. And in doing the things which the defendant knew or should have known affecting the safety of third persons, defendant had a duty to such third persons to do carefully what it undertook to do.

A security company assumes such a duty when it enters into a security contract. Brown, 679 S.W.2d at 309; see also Erickson v. Curtis Investment Co., 447 N.W.2d 165, 170 (Minn.1989) (security company liable because it undertook for another to perform a duty owed by the other to a third person); Jones v. Tokhi 193 Wis.2d 514, 535 N.W.2d 46 (App.1995); Professional Sports, Inc. v. Gillette Security, Inc., 159 Ariz. 218, 766 P.2d 91 (App. 1988); Restatement (Second) of Torts s. 324A. “The existence of a duty will turn on the terms of the contract and the circumstances.” Id. “[T]he proper inquiry is simply whether the defendant has assumed a duty to exercise reasonable care to prevent foreseeable harm to the plaintiff.” Eaves Brooks Costume Company Inc. v. Y.B.H. Realty Corp., 76 N.Y.2d 220, 557 N.Y.S.2d 286, 556 N.E.2d 1093, 1096 (1990).

The provisions of the contract, as well as portions of the training manual and the policy and procedures manual, as indicated above, clearly set out IPC’s general duty to “exercise reasonable care to prevent foreseeable harm” to plaintiff, Eaves Brooks, 557 N.Y.S.2d 286, 556 N.E.2d at 1096, and this general duty is sufficient to support plaintiffs claim.

In this case, however, a more specific duty is alleged when A.G. approached two separate IPC guards, to seek help for L.A.C., to no avail. A security company has a duty to take reasonable measures to protect business invitees if the company or officer is notified of a specific danger to a business invitee. In such a case, the first “special circumstances” exception applies. “When a criminal episode on the premises has begun to unfold and the possessor or his employees are, or should be, aware of it, the issue of foreseeability disappears. It would seem logical that the possessor would then owe entrants a duty of reasonable care under the circumstances.” The Law of Premises Liability sec. 11.11.

IV.

The trial court rested its grant of summary judgment solely on findings that plaintiff failed to establish that any party had a duty to protect her from criminal acts of third persons, and that plaintiff could not bring suit against IPC as a third party beneficiary of its contract with the Ward Parkway Group. This was error. The Court is not presented with and does not address whether plaintiff has sufficiently pleaded or can prove the remaining elements of her negligence and contract claims.

This decision does not abrogate the traditional notion that an “[owner of property] is not an insurer of his invitee’s safety.” Faheen v. City Parking Corp., 734 S.W.2d 270, 273 (Mo.App.1987). Plaintiff still has the considerable burden to prove that the measures undertaken by the mall management and IPC were not reasonable in fight of the circumstances, and that any failure in implementing those measures caused injury to her.

The judgments as to both the Ward Parkway Group and IPC are reversed and remanded.

WHITE, WOLFF and LAURA DENVIR STITH, JJ., concur.

STEPHEN N. LIMBAUGH, Jr., C.J., dissents in separate opinion filed; BENTON, J., concurs in opinion of LIMBAUGH, C.J.

RICHARD B. TEITELMAN, J., not participating.

STEPHEN N. LIMBAUGH, JR., Chief Justice,

dissenting.

I respectfully dissent.

I.

With regard to the claims against Ward Parkway, the owner of the premises, I disagree with the majority’s indiscriminate reliance on crimes of all categories in determining the existence of a duty to protect. I am particularly concerned that, as a practical matter, the majority’s application of the violent crimes exception, which by definition should be applied only under extraordinary circumstances, swallows up the general rule that “there is no duty to protect business invitees from the criminal acts of unknown third persons,” Madden v. C & K Barbecue Carryout, Inc., 758 S.W.2d 59, 61 (Mo. banc 1988).

The violent crimes exception to the general rule of non-liability requires that there must be “evidence of prior criminal incidents sufficient to alert management to the possibility that his patrons might be in danger.” Id. at 62 (citing Virginia D. v. Madesco Investment Corp., 648 S.W.2d 881 (Mo. banc 1983)). The number, time of occurrence, and similarity of criminal incidents are the principal factors that give rise to foreseeability and, in turn, the duty to protect. Hudson v. Riverport Performance Arts Ctr., 37 S.W.3d 261, 264-65 (Mo.App.2000); Wood v. Centermark Props., Inc., 984 S.W.2d 517, 524 (Mo.App. 1998); Faheen, By and Through Hebron v. City Parking Corp., 734 S.W.2d 270, 274 (Mo.App.1987). However, in its review of prior criminal incidents, the majority relies almost totally on incidents that are significantly dissimilar to the incident in this case — the violent abduction and rape of a young woman.

A close look at the majority’s chart of prior criminal activity proves the point. Of the seventeen crimes listed, eleven occurred in the parking lot, rather than inside the mall where the crime in question occurred. Obviously, in mall parking lots, persons are more exposed to crime because they may be easily isolated and a quick escape by an attacker is readily available. On the other hand, inside the mall, there are many employees and customers who may come to the aid of a victim and whose very presence serves to dissuade potential attackers. Thus, an important distinction may be made between crime in the parking lot and crime in the mall. See Wood v. Centermark Props., 984 S.W.2d at 524; Pickle v. Denny’s Restaurant, Inc., 763 S.W.2d 678, 681 (Mo.App. 1988) (excluding from consideration crimes that occurred indoors where the crime in question occurred outdoors). Indeed, the majority’s own statistical analysis of the location of the crimes bears this out.

Of the six remaining crimes from the list of seventeen, none is remotely similar to the kind of criminal offense present here. One incident involved a man who had fallen asleep drunk at a mall restaurant and who attacked a bartender and a security officer with a knife when the bartender attempted to wake him. Another incident concerned a teenager who “was molested by a stranger in the mall movie theater,” but the record indicates that the incident is more properly characterized as a misdemeanor-level offensive touching. The chart also mentions that a “mall employee was robbed in the mall of his wallet at knifepoint.” This incident occurred after midnight, after the mall was closed, and the employee-victim was one of the janitors. The chart’s entry of 8-11-95, that “a woman entering the mall was assaulted by three women who kicked and punched her,” actually involved three female teenagers who assaulted a fourth teenager entering the arcade from the parking lot late one Friday night after the mall shops closed. The majority’s chart also contains the entry of 4-15-96 that a mall restaurant employee committed a sexual assault on a fellow employee in the mall bathroom. Suffice it to say that mall employees are not “unknown assailants” as required by the violent crimes exception. Finally, the most grievous incident is that “an employee of a mall restaurant held the store manager at knife point, forcing her to open the safe and then abducting her.” Again, co-employees are not “unknown assailants.” In sum, not one of these incidents, nor any of them together, are sufficient to alert management to the possibility that a mall patron might be in danger of a violent abduction and rape.

The majority also suggests that the fist of seventeen is merely representative of many other reports of violent crimes at the mall. I agree! Just as with the list of seventeen, none of the other incidents were significantly similar to that involving plaintiff. A review of the remaining reports reveals that, with a single exception, all incidents of violent crimes can be categorized as either parking lot crimes, robberies of mall stores and other assaults of store employees (usually by disgruntled customers), and consensual fights among teenagers. The single exception, which alone is insufficient to impose a duty on the mall owner, involved an unarmed man who robbed an elderly woman near the mall entrance.

This is not a case like Madden, the case on which the majority primarily relies. Although Madden also involved an abduction of a business patron, the abduction occurred on a small restaurant parking lot, and the duty to protect restaurant patrons was based on a recent history of six armed robberies and six strong-armed robberies of patrons on the same parking lot. Madden v. C & K Barbecue Carryout, Inc., 758 S.W.2d at 60.

Tellingly, the majority fails to cite Wood v. Centermark Properties, Inc., 984 S.W.2d 517 (Mo.App.1998), the only case to address the liability of mall owners for violent crimes committed against mall patrons and employees. In Wood, the court refused to impose liability on the mall owner even for a parking lot abduction. Plaintiff had identified eighty incidents of violent crimes occurring both inside and outside the mall, but, after an initial review, the court culled the bulk of the crimes from the list. Id. at 524. “After excluding all of the incidents off the premises and inside the mall and all incidents of indecent exposure and injuries resulting from escaping shoplifters, there remained] about 20 incidents of allegedly violent crimes.... ” Id. These included several fights among mall patrons, five purse snatehings, two strong-armed robberies, and a “robbery holdup where a small hard object was placed in the victim’s back as she was robbed,” id. at 524-25, but none of the victims were severely injured, and the only items stolen were purses, bags, or jewelry, id. at 525. Ultimately, the court held that the violent crimes in question were too dissimilar to put the mall owners on notice that mall patrons would be at risk of being abducted in the parking lot.

The inescapable conclusion to be drawn from Wood is that if the prior criminal activity in that case was too dissimilar to give rise to a duty to protect mall patrons from being abducted from the mall parking lot, then certainly the prior criminal activity in the case at hand was too dissimilar to give rise to a duty to protect mall patrons from abduction inside the mall itself. Accordingly, I would not impose liability on Ward Parkway.

II.

Regarding the claims against IPC, the security company, I disagree with the majority on both grounds: 1) that IPC is liable to plaintiff because plaintiff is a third-party beneficiary of the security agreement and 2) that IPC is liable .to plaintiff because the security agreement establishes that IPC has a duty in tort to protect plaintiff.

The simple answer on the first claim is that plaintiff cannot be a third-party beneficiary if it is determined in the first instance, as I would hold, that Ward Parkway, the mall owner, had no duty to protect plaintiff. Under the majority’s analysis, plaintiff is a “creditor beneficiary” because the performance of IPC’s promise to provide security for the mall “will satisfy an actual or supposed or asserted duty that the mall owners owed to plaintiff.” Absent that duty, however, there can be no creditor beneficiary.

The claim that the security contract imposes a duty on IPC is directly contrary to the long-established precedent of this Court that a party not privy to a contract may not use the duties created thereunder as a basis for tort. Roddy v. Mo. Pac. Ry. Co., 104 Mo. 234, 15 S.W. 1112 (1891). The majority relies upon an exception discussed in dicta in Wolfmeyer v. Otis Elevator Co., 262 S.W.2d 18, 22 (Mo.1953), that “a defendant, by entering into a contract, may place himself in such a relation toward third persons as to impose upon him an obligation to act in such a way that they will not be injured.” In Westerhold v. Carroll, 419 S.W.2d 73, 77-79 (Mo.1967), however, this Court clarified its comments in Wolfmeyer by holding that the exception to privity that allows a third party to sue in tort for breach of the contract is very limited and narrow and applies only in cases where the relationship between the third party and the contracting party was so close “as to approach that of privity.” Id. at 78. The Court also emphasized that where the purpose of the privity requirement is to prevent exposing the parties to “unlimited liability to an unlimited number of persons,” the general rule should remain in effect. Id. In this case, there certainly is no relationship between plaintiff and IPC so close “as to approach that of privity,” and to disregard the privity requirement would indeed subject the security company to unlimited liability to an unlimited number of persons — the many thousands of patrons and employees of the mall — which is exactly what Wester-hold forbids.

Finally, the majority holds that IPC’s duty to act arose when plaintiffs friend, A.G., informed two IPC officers of the abduction. The majority’s reasoning is that the situation fits into the “first special facts and circumstances” exception where “a person, known to be violent, is present on the premises or an individual is present who has conducted himself so as to indicate danger and sufficient time exists to prevent injury.” Faheen, By and Through Hebron v. City Parking Corp., 734 S.W.2d at 273. First, this argument is not raised by the plaintiff at any point. Second, the exception to which the majority refers is inapposite. It applies only where a person is previously known to be dangerous, based upon that person’s “character, past conduct and tendencies.” Scheibel v. Hillis, 531 S.W.2d 285, 288 (Mo. banc 1976).

III.

For these reasons, I would affirm the judgments entered by the circuit court. 
      
      . Defendants' statements of fact deviate substantially from the plaintiff’s version. Each defendant alleges that L.A.C. referred to her assailant as her boyfriend, and was laughing and giggling when her friend, A.G., first saw her after the incident. A.G.’s deposition testimony varied substantially from her earlier testimony at the juvenile proceedings of the assailant. In her deposition, she opined that she did not believe that A.G. was raped, and testified that she only contacted one IPC security guard while searching for plaintiff.
     
      
      . I. 3. A. Make frequent, random rounds of the premises, the common areas of the center, sidewalks, parking lots, ring roads, checking gates, doors, windows, and lights. Make frequent, random motorized patrols of the parking lots and ring roads, and perform other Security tasks as instructed by manager.
      
        
      
      I. CONTRACTOR shall instruct Security Officers to patrol assigned areas; observe activities; conduct routine rounds of the interi- or and exterior of the premises and complete reports. CONTRACTOR shall provide training to its employees to insure such employees know the general orders for Security Officers and the special orders for any post to which he/she is assigned. CONTRACTOR’S officers shall safeguard equipment and material against damage, theft, loss or unauthorized use; and slay alert for any security or safety hazards at all times.
     
      
      . Defendant IPC alleges that these records are hearsay. "Only evidentiary materials that are admissible or usable at trial can sustain or avoid summary judgment.” Partney v. Reed, 889 S.W.2d 896, 901 (Mo.App.1994). "A record of an act, condition or event, shall, insofar as relevant, be competent evidence if the custodian or other qualified witness testifies to its identity and the mode of its preparation, and if it was made in the regular course of business, at or near the time of the act, condition or event, and if, in the opinion of the court, the sources of information, method and time of preparation were such as to justify its admission.” Section 490.680, RSMo (2000). Some police records were attached with the IPC incident reports. If properly authenticated and within a recognized hearsay exception, these may be admissible. However, for purposes of this appeal only the incident reports produced by IPC during discovery are considered. Defendants concede that these records are their internal reports. Defendant cannot defeat summary judgment based on an objection regarding any supposed failure to authenticate records that they provided and to which they make no specific denial regarding their authenticity. Lutsky v. Blue Cross Hospital Service, Inc., 695 S.W.2d 870, 872 (Mo. banc 1985).
     
      
      . The incident report summaries contain a large percentage of victims classified as "business,” a category which is not broken up by gender.
     
      
      . The crime occurred on Saturday, March 15, 1997.
     
      
      . Rule 55.27(b) permits a trial court to treat a motion for judgment on the pleadings as a motion for summary judgment if matters outside the pleadings are presented. A trial court must give notice to the parties and an opportunity to present opposing materials. Arnold, v. American Family Mut. Ins. Co., 987 S.W.2d 537, 539 (Mo.App.1999). Plaintiff introduced a plethora of material in opposition.
     
      
      .Plaintiff also submitted a letter from anonymous tenants of the mall in which the writer complained to mall management of the level of crime at the mall. However, the letter is dated March 25, 1997, 10 days after the rape of plaintiff. Because the letter was written after the date of this incident, it cannot be relevant to the determination of whether the crime was foreseeable.
     
      
      . As discussed below, the first exception may apply to IPC only.
     
      
      . Twelve of the seventy-five incident reports involved both male and female victims, businesses or unidentifiable victims.
     
      
      . To determine foreseeability, Madden examined all "crimes committed on the premises” of the business. 758 S.W.2d at 61. Even were we to analyze prior crimes at the mall in relation to whether they occurred inside the mall or outside on the mall’s parking lot, it would not help defendants. L.A.C. alleges that her abduction occurred inside the mall, and that her rape occurred outside the mall on the catwalk leading to the parking lot. Prior crimes in both locations are directly involved.
     
      
      . Notably, other states have found a duty to take reasonable measures to protect business invitees or tenants from rape, based on evidence of other crimes, including burglary, armed robberies, assaults, kidnapping and breaking and entering. Sturbridge Partners v. Walker, 267 Ga. 785, 482 S.E.2d 339 (1997); Marshall v. David’s Food Store, 161 Ill.App.3d 499, 113 Ill.Dec. 325, 515 N.E.2d 134 (1987); Murrow v. Daniels, 321 N.C. 494, 364 S.E.2d 392 (1988). See also Matthew J. Landwehr, Book Note, “Come One, Come All, but Watch Your Back!” Missouri Sides with Business Owners in Negligent Security Action, 67 Mo. L.Rev. 59. While we need not consider the use of evidence of off-premises or surrounding neighborhood crimes, as some of these courts do, these cases are instructive regarding the relevance of all violent crimes and protection against rape.
     
      
      . We hold only that a duty exists, not the extent of the duty. In any particular case, the range of duty for a shopping mall owner may extend from locks on doors or proper lighting to employing security guards or installing a security system, etc. Specific evidence will be necessary concerning what measures a reasonable and prudent shopping mall owner should utilize given the circumstances of the particular shopping mall. For example, an issue in this case may be whether the Ward Parkway Group fulfilled its duty by contracting with IPC.
     
      
      . The dissent's implication that Wolfmeyer was limited by Westerhold v. Carroll, 419 S.W.2d 73 (Mo.1967), appears mistaken. Westerhold discusses Wolfmeyer, as follows:
      [A] party by entering into a contract may place himself in such a relation toward third persons as to impose upon him an obligation to act in such a way that the third persons will not be damaged. Wolfmeyer v. Otis Elevator Co., 262 S.W.2d 18. In Lambert v. Jones, 339 Mo. 677, 98 S.W.2d 752, 758, it was stated that where one under contract with another assumes responsibility for property or instrumentalities and agrees under his contract to do certain things in connection therewith which, if left undone, would likely injure third persons, "there seems to be no good reason why [he] should not be held liable to third persons injured thereby for his failure to do that which he agreed to do, which he assumed responsibility for, and which was reasonably necessary to be done for their protection.”
      
        Westerhold, 419 S.W.2d at 80.
     
      
      . Ten of the eleven are expressly designated in the chart as having occurred in the parking lot. The first entry — an assault on 3-13-97— also occurred in the parking lot, but the entry was not designated as such.
     
      
      . The majority's footnoted response to the fact that parking lot crimes are dissimilar is to emphasize that although the abduction occurred inside the mall, the rape occurred on a catwalk outside the mall. However, the record shows that the catwalk is a secluded, narrow, employees-only walkway abutting the mall building proper and accessible to mall patrons only through emergency exit doors. This was simply not a parking lot crime.
     