The opinion of the court was delivered by

McFARLAND, J.:

This is a premises liability action brought by a woman who was shot in the parking lot of a shopping center in an armed robbery by an unknown assailant. Liability is sought to be imposed upon the owner of the shopping center on the basis of negligence in not providing security for the area. The district court, utilizing the "prior similar incidents" rule of foreseeability, entered summary judgment in favor of the defendant. The plaintiff appeals therefrom.

Preliminarily, some rules relating to the granting of summary judgment in a negligence action need to be set forth. In Gooch v. Bethel A.M.E. Church, 246 Kan. 663, 668, 792 P.2d 993 (1990), we stated:

"`The burden on the party seeking summary judgment is a strict one. The trial court is required to resolve all facts and inferences which may reasonably be drawn from the evidence in favor of the party against whom the ruling is sought. On appeal we apply the same rule, and where we find reasonable minds could differ as to the conclusions drawn from the evidence, summary judgment must be denied. [ Lessley v. Hardage, 240 Kan. 72, 73-74, 727 P.2d 440 (1986).] The party opposing summary judgment, however, has the affirmative duty to come forward with facts to support its claim, although it is not required to prove its case. [ Willard v. City of Kansas City, 235 Kan. 655, Syl. ¶ 2, 681 P.2d 1067 (1984); Mays v. Ciba-Geigy Corp., 233 Kan. 38, Syl. ¶ 5, 661 P.2d 348 (1983).] If factual issues do exist, they must be material to the case to preclude summary judgment. Bacon v. Mercy Hosp. of Ft. Scott, 243 Kan. 303, 306-07, 756 P.2d 416 (1988)."

There are controverted facts relative to whether plaintiff Betsy Seibert had the legal status of a licensee or business invitee at the time she was injured. For purposes of ruling on the defendant's summary judgment motion, the district court, appropriately, held Ms. Seibert to be a business invitee. We shall do the same.

On April 2, 1989, Ms. Seibert was a passenger in an automobile owned and driven by her friend Michelle Brandes. At about 3:00 p.m., they drove to the Ranch Mart Shopping Center and parked in the subterranean parking garage. They got out of the automobile and reached into the back to retrieve their purses from the "cubby" area of the Corvette. Suddenly, each had an assailant. Where the two robbers had been prior to assaulting the women is unknown. Ms. Seibert had her handbag and a cola can in her hands. When confronted, Ms. Seibert screamed and either dropped or threw the can of cola at her assailant, who then shot her in the head. The robbers fled.

Ms. Seibert brought this action against Vic Regnier Builders, Inc., the owner of Ranch Mart, Inc., alleging it was negligent in not providing security for its patrons when the assault upon her was foreseeable. Specifically, she alleged that by virtue of past criminal activity in the shopping center's parking areas plus the nature of the underground parking area, including dim lighting by virtue of numerous burned-out fluorescent tubes, the defendant owed a duty to her as a business invitee to provide security. The shopping center had no security for its patrons — no warning signs, video surveillance, or security guards. The plaintiff offered expert testimony that the security, including the lighting, was inadequate and had appropriate security measures been in place, the attack upon her would probably not have occurred.

No evidence of prior crimes in the underground parking area was offered or suggested. There was sketchy evidence of crimes occurring in above-ground areas of the parking lot, as follows: (1) Prior to 1986, a car window was broken and personal property taken from the vehicle; (2) in 1986, an armed robbery occurred (details unknown); (3) in 1988, a strong-armed robbery attempt was interrupted when witnesses intervened, and a second armed robbery was thwarted when the victim resisted.

In granting summary judgment to the defendant premises owner, the district court stated:

"Maybe you can get the guys up in the appellate courts to tell me I'm wrong, but in this case, factually, there are a total of four crimes in the preceding two years upon which to base a conclusion that there would be a criminal act taking place in the future, and I think the rest of the facts are in a good posture for the appellate courts to deal with this case.

"This is an underground garage and, frankly, the plaintiff has facts which are as favorable as they could probably be in the absence of a lot of criminal activity. Like, I would assume, Indian Springs, for example, over in Wyandotte County would be one where there wouldn't be an issue as to the requirement to provide security. But you have a lot of other things going here, including the lighting issue, the underground garage which takes the public out of view of other members of the public; it's secluded. Those are facts that are, frankly, favorable to the plaintiff, but I just don't know where to draw the line here.

"So, I'm going to find in this case that the criminal act was not foreseeable.

"Let me go back and briefly make some other rulings in the case so that if it does go up, the appellate courts have the ability to rule on whatever issues they want to rule on.

"I'm going to find that there's a question of fact as to whether or not the plaintiff is a business visitor or a licensee, and that would be an issue which would ultimately be decided by a jury if the case is heard by a jury. So for purposes of deciding this motion, I'm making the assumption that the plaintiff is a business invitee. Under that situation, the defendant then is under a duty to maintain the premises in a reasonably safe condition.

"In this case there is no factual basis for either of the following: One, a requirement that the defendant provide security on the premises; or, two, there is no factual basis to find that the defendant would have reason to anticipate a criminal act would occur. In other words, the criminal act which resulted in plaintiff's injuries in this case was not foreseeable.

"I'll just simply adopt those portions of the facts which are really not controverted, and I think the only ones that are significant in this case are the ones that deal with lighting. There is a question of fact as to the condition of the lighting. For purposes of this motion, I'm assuming that there were lights that were not working in the garage. In other words —

"MR. HAUBER [defense counsel]: As opposed to the sidewalk or —

"THE COURT: In the area. The effect of my ruling is, basically, even if there was no lighting, the criminal act was still not foreseeable. So, see, the lighting, factually, doesn't become a factual issue in the case."

The plaintiff contends that under the "prior similar incidents" rule utilized by the district court, the court erred in holding that such prior incidents were insufficient to establish a duty owed. Alternatively, plaintiff contends the court erred in not applying the broader "totality of the circumstances" rule. The two rules are different methods for determining the foreseeability requirement of whether or not there is a duty owed by the premises owner to the customer injured by the criminal conduct of a third party.

In 62A Am.Jur.2d, Premises Liability § 513, p. 69, it is stated:

"In accordance with the general rule (subject to some major exceptions) that an owner of premises has no duty to protect another from criminal attack, a storekeeper or proprietor of other commercial premises will not generally be held responsible for the willful criminal act of a third person which could not be foreseen or anticipated."

The difference between the two methods of determining foreseeability is stated in 62A Am.Jur.2d, Premises Liability § 520, p. 77, as follows:

"Where the courts apply the `prior similar incidents' test of foreseeability, the occurrence of prior offenses on the premises is a key element of proof, and the proffered offenses apparently must be not only of the same type and nature as the offense complained of, but also must have occurred with some frequency. What constitutes sufficient frequency is difficult to predict. For example, in a case involving the abduction and rape of a parking lot patron, the court held that the plaintiff's evidence showing 10 larcenies and robberies at the defendant's ramp garage in the 10 years preceding the attack was insufficient to alert the parking lot proprietor to the possibility that the particular crime complained of might occur. Some courts have abrogated the `prior similar incidents' test in favor of the `totality of circumstances' test on the ground that application of such test contravened the policy of preventing future harm by forestalling a duty to safeguard until someone was injured; invaded the province of the jury to determine foreseeability from all of the facts and circumstances, and erroneously equated foreseeability of a particular act with previous occurrences of similar acts. Under such a rule, patrons are not limited to past experience in establishing that a new business owes them a duty of protection from criminal conduct by third persons; foreseeability of criminal conduct may be established by the place and character of the business.

" Comment: This is in accord with the comment to the Restatement that a possessor of land has a duty to take precautions against criminal conduct on the part of third persons if the place or character of his business, or his past experience, is such that he should reasonably anticipate careless or criminal conduct on the part of third persons.'"

The above reference to the Restatement is to Restatement (Second) of Torts § 344 (1965), which states:

"A possessor of land who holds it open to the public for entry for his business purposes is subject to liability to members of the public while they are upon the land for such a purpose, for physical harm caused by the accidental, negligent, or intentionally harmful acts of third persons or animals, and by the failure of the possessor to exercise reasonable care to (a) discover that such acts are being done or are likely to be done, or (b) give a warning adequate to enable the visitors to avoid the harm, or otherwise to protect them against it."

Comment f to § 344 explains that although the owner of the property is not an insurer of the land, there are certain circumstances in which liability is warranted:

"Since the possessor is not an insurer of the visitor's safety, he is ordinarily under no duty to exercise any care until he knows or has reason to know that the acts of the third person are occurring, or are about to occur. He may, however, know or have reason to know, from past experience, that there is a likelihood of conduct on the part of third persons in general which is likely to endanger the safety of the visitor, even though he has no reason to expect it on the part of any particular individual. If the place or character of his business, or his past experience, is such that he should reasonably anticipate careless or criminal conduct on the part of third persons, either generally or at some particular time, he may be under a duty to take precautions against it, and to provide a reasonably sufficient number of servants to afford a reasonable protection."

The plaintiff acknowledges there are no Kansas cases precisely on point. She likens the situation herein to those in Gould v. Taco Bell, 239 Kan. 564, 722 P.2d 511 (1986), and the earlier Kimple v. Foster, 205 Kan. 415, 469 P.2d 281 (1970). There are some significant distinctions between the Gould/Kimple cases and the factual situation before us. In both Gould and Kimple the criminal assaults occurred among fellow patrons of a restaurant and tavern, respectively. Explosive confrontational situations developed inside the business premises. The proprietors neither intervened nor called the police.

In Gould, we stated:

"Appellant first argues a premises owner cannot be held liable for injuries sustained in a sudden attack upon one patron by another.

"The duty of care owed by a premises owner to an entrant upon the land is dependent upon the status of the person entering the premises. A restaurant patron is an `invitee.' We defined that term and discussed the duty of care owed to an invitee in Gerchberg v. Loney, 223 Kan. 446, 449, 576 P.2d 593 (1978):

`An invitee is one who enters or remains on the premises of another at the express or implied invitation of the possessor of the premises for the benefit of the inviter, or for the mutual benefit and advantage of both inviter and invitee. The possessor of premises on which an invitee enters owes a higher degree of care, that of reasonable or ordinary care for the invitee's safety. This duty is active and positive. It includes a duty to protect and warn an invitee against any danger that may be reasonably anticipated.'

"Thus, Taco Bell owed Rosie Gould an affirmative duty to exercise reasonable or ordinary care for her safety. This duty included an obligation to warn her against any danger that might reasonably have been anticipated.

"In Kimple v. Foster, 205 Kan. 415, 469 P.2d 281 (1970), we discussed the liability of a business owner for an intentional, harmful assault upon a patron by another patron and set forth the general rule as follows:

`A proprietor of an inn, tavern, restaurant or like business is liable for an assault upon a guest or patron by another guest or third party where the proprietor has reason to anticipate such an assault and fails to exercise reasonable care to forestall or prevent the same.' Syl. ¶ 2.

`The duty of a proprietor of a tavern or inn to protect his patrons from injury does not arise until the impending danger becomes apparent to him, or the circumstances are such that a careful and prudent person would be put on notice of the potential danger.' Syl. ¶ 3.

"This rule is consistent with that set forth in Restatement (Second) of Torts § 344 (1963):

`A possessor of land who holds it open to the public for entry for his business purposes is subject to liability to members of the public while they are upon the land for such a purpose, for physical harm caused by the accidental, negligent, or intentionally harmful acts of third persons or animals, and by the failure of the possessor to exercise reasonable care to

`(a) discover that such acts are being done or are likely to be done, or

`(b) give a warning adequate to enable the visitors to avoid the harm, or otherwise to protect them against it.'

"For an excellent annotation on the liability of an innkeeper, restauranteur, or tavern keeper for injury occurring on the premises to a guest or patron by a third person, see Annot., 70 A.L.R.2d 628, §§ 13, 14. See also 40 Am.Jur.2d, Hotels, Motels, Etc. § 112, p. 987.

"Appellant compares the facts of the present case to those in Kimple v. Foster, 205 Kan. 415, and argues our holding in Kimple is inapplicable to the facts of this case.

"In Kimple, the plaintiffs were injured while guests at a bar owned by the defendant. The plaintiffs were the victims of an unprovoked attack by another group of patrons who had been drinking, harassing patrons, and brawling in the bar for several hours. A jury found the tavern owner liable for injuries sustained by the plaintiffs. On appeal, the tavern owner argued that a proprietor's duty to protect his patrons does not arise until the impending danger becomes apparent to the tavern keeper, or the circumstances are such that an alert and prudent person would be placed on notice of the probability of danger. 205 Kan. at 417.

"The Kimple court concluded the facts present were clearly sufficient to warrant the jury in concluding that the defendant had knowledge of facts which should reasonably have placed him on notice that trouble might be expected which would endanger the safety of the patrons. 205 Kan. at 418. Specifically, the court noted there was evidence to the effect that, before the physical attack commenced, the plaintiffs and other patrons repeatedly told tavern employees to call the police but to no avail. Further, the court cited evidence that the battle had `raged' for a full ten minutes before the police were called. 205 Kan. at 419.

"Appellant argues our reasoning in Kimple is inapplicable to the present case because the facts of this case `contrast strongly' with those in Kimple. Appellant claims the assault on Rosie Gould lasted only about five minutes while the assault on the plaintiffs in Kimple consisted of a `five-hour sequence of events.' Appellant misstates the facts in Kimple. As in the present case, the actual assault upon the plaintiffs in Kimple lasted only a few minutes. It is true, however, that in Kimple the assailants had been in the bar for several hours prior to the incident, while in the present case, Karen Brown and her friends had been at Taco Bell only a few minutes. But in this case, there is evidence Brown had been involved in a similar altercation at Taco Bell approximately two weeks before she attacked Rosie Gould. Also, there was evidence Taco Bell management had considered hiring security personnel because of a history of rowdyism on the premises.

"In Kimple, we made the following statement regarding notice to the proprietor:

"`It is not required that notice to the proprietor of such an establishment be long and continued in order that he be subject to liability; it is enough that there be a sequence of conduct sufficient to enable him to act on behalf of his patron's safety.' 205 Kan. 415, Syl. ¶ 4.

"The evidence in this case was sufficient to establish such a `sequence of conduct.' Thus, we hold the jury's verdict against Taco Bell for Gould's injuries is supported by the evidence." 239 Kan. at 567-69.

In the case before us, the attack upon the plaintiff did not occur inside the business premises under the noses, so to speak, of the proprietors. The attack occurred in a parking lot. Neither the premises owner nor any of its employees were aware of the presence of the plaintiff or her attackers or that an attack was occurring. Neither failure to intervene nor to summon police is the basis of liability asserted herein, as was true in the Gould and Kimple cases. Rather, the liability sought to be imposed herein is predicated upon the frequency and severity of prior attacks against different patrons by presumably different attackers at different times and in different areas of the parking lot, plus the totality of the circumstances making the attack upon the plaintiff or some other business invitee foreseeable to the defendant, who then had a duty to take appropriate security action to prevent or make less likely the same from occurring.

Negligence exists where there is a duty owed by one person to another and a breach of that duty occurs. Further, if recovery is to be had for such negligence, the injured party must show: (1) a causal connection between the duty breached and the injury received; and (2) he or she was damaged by the negligence. Whether a duty exists is a question of law. Whether the duty has been breached is a question of fact. Durflinger v. Artiles, 234 Kan. 484, 488, 673 P.2d 86 (1983).

In determining whether there is a duty owed, we start with two general rules. The owner of a business is not the insurer of the safety of its patrons or customers. The owner ordinarily has no liability for injuries inflicted upon patrons or customers by the criminal acts of third parties in the business' parking lot, as the owner has no duty to provide security. Such a duty may arise, however, where circumstances exist from which the owner could reasonably foresee that its customers have a risk of peril above and beyond the ordinary and that appropriate security measures should be taken. In determining foreseeability, should the rule be limited to prior similar acts or include the totality of the circumstances? An annotation on the liability of a for-pay parking lot for injuries to its customers which were the result of criminal attacks upon its customers appears in 49 A.L.R.4th 1257. The annotation discusses both methods of determining foreseeability.

An annotation on a shopping mall owner's liability for criminal attack in a mall's free parking areas appears at 93 A.L.R.3d 999.

Our sister state of Missouri has had occasion to consider the issue. Madden v. C K Barbecue Carryout, Inc., 758 S.W.2d 59 (Mo. 1988), consisted of two cases consolidated for appeal — Madden and Decker v. Gramex Corporation. Plaintiff Madden was kidnapped in the defendant's parking lot in St. Louis and driven to another location where she was sexually assaulted. In Decker, Mr. and Mrs. Decker were kidnapped from the defendants' St. Louis County parking lot. Thereafter Mrs. Decker was sexually assaulted and both were murdered. Liability was claimed in both cases under the prior similar incidents standard of foreseeability. Summary judgment was entered on behalf of the defendant in Decker, and Madden was dismissed for failure to state a claim. The Missouri Supreme Court reversed the district court decisions in both cases. In so doing, Missouri recognized a cause of action wherein owners of businesses could be held liable for crimes in their parking lots where the same are foreseeable by virtue of numerous instances of prior criminal conduct occurring therein.

Perhaps the most commonly cited case accepting the totality of circumstances rule of foreseeability is Isaacs v. Huntington Memorial Hospital, 38 Cal.3d 112, 211 Cal.Rptr. 356, 695 P.2d 653 (1985). The scene of the crime was the physicians' parking lot at a major hospital located in what was stated to be a high crime area. At the nearby emergency room parking area, numerous crimes had occurred, and security guards were employed therein. The emergency department was open 24 hours a day and attracted large numbers of drunks, drug addicts, and assorted violent criminal types. Dr. Isaacs was an anesthesiologist who was shot by an assailant near his car in the physicians' parking lot. There had been no prior criminal incidents in this parking lot. The California Supreme Court rejected the prior similar incidents rule and embraced the totality of the circumstances test for foreseeability. In essence, the California court held that this particular parking lot could not be isolated and foreseeability based just upon events therein. The lot was in a high crime area and adjacent to the emergency room parking lot where violent behavior was known to be a common occurrence requiring security. 38 Cal.3d at 130-31.

We believe that totality of the circumstances is the better reasoned basis for determining foreseeability. The circumstances to be considered must, however, have a direct relationship to the harm incurred in regard to foreseeability. Prior incidents remain perhaps the most significant factor, but the precise area of the parking lot is not the only area which must be considered. If the parking lot is located in a known high crime area, that factor should be considered. For instance, one should not be able to open an all-night, poorly lit parking lot in a dangerous high crime area of an inner city with no security and have no legal foreseeability until after a substantial number of one's own patrons have fallen victim to violent crimes. Criminal activity in such circumstances is not only foreseeable but virtually inevitable.

It is a sad commentary on our times that there is probably no shopping center parking lot that is likely to be crime free. Thefts of vehicles and from vehicles do occur, as well as purse snatches, etc. It is only where the frequency and severity of criminal conduct substantially exceed the norm or where the totality of the circumstances indicates the risk is foreseeably high that a duty should be placed upon the owner of the premises to provide security. The duty to provide security is determined under the reasonable person standard. Thus, the duty to provide security and the level of such security must be reasonable — that includes the economic feasibility of the level of security. In some instances, the installation of better lighting or a fence or cutting down shrubbery might be cost effective and yet greatly reduce the risk to customers. We note with concern the plaintiff's expert's references to the security not being adequate or being inadequate. This is a poor choice of terms. Presumably, the fact that the attack on the plaintiff occurred shows that the security was "inadequate." Had it been "adequate" the attack would not have occurred. The shopping center owner is not under a duty to provide such security as will prevent attacks on the patrons — such a duty would make the owner the insurer of his patrons' safety. Rather, if because of the totality of the circumstances the owner has a duty to take security precautions by virtue of the foreseeability of criminal conduct, such security measures must also be reasonable under the totality of the circumstances. Such an approach is consistent with the Restatement (Second) of Torts § 344 (1965).

The district court limited its consideration to specific similar incidents. The court expressly did not consider the claims as to the lighting deficiencies and other characteristics of the parking area in question. Further, the court did not make any findings as to whether the premises were or were not in a high crime area, although inferentially, by its comment relative to the Indian Springs Shopping Center, the question was answered in the negative. We must reverse and remand the case for reconsideration under the totality of the circumstances test for foreseeability. The circumstances to be considered must relate specifically to the foreseeability of the attack on the plaintiff. We note that under the facts presented, it is unknown where plaintiff's and her friend's assailants were immediately prior to the attack. Thus, the district court will have to consider the claims of deficient lighting in the context of whether this factor played any role in increasing the risk of this attack upon the plaintiff.

The summary judgment is reversed, and the case is remanded for reconsideration under the totality of the circumstances test of foreseeability.