¶ 1 On the evening of October 2, 2013, Karla Gress was a guest at the Holiday Inn Chicago-Skokie (Skokie Holiday Inn), which was owned and/or managed by defendants Lakhani Hospitality, Inc. (LHI), and Mansoor Lakhani (Lakhani). After eating dinner and consuming an alcoholic beverage in the hotel restaurant, Karla went to her room where she was subsequently raped while unconscious, allegedly by the hotel security guard who also did some maintenance work at the hotel.

¶ 2 Karla and her husband, Dean Gress (via a loss of consortium claim) (plaintiffs), brought a premises liability action against LHI; Lakhani; hotel Director of Operations Sheila Gilani; and the LHI franchisors, Intercontinental Hotels Group Operating Corporation and Intercontinental Hotels Group Resources, Inc. (collectively Intercontinental). As to the alleged offender, Alhagie Singhateh, plaintiffs claimed that he committed assault and battery, as well as intentional infliction of emotional distress and gender violence. Plaintiffs also sued Intercontinental and Hostmark Hospitality Group, Inc. (Hostmark) for negligently hiring and retaining Singhateh, alleging that Hostmark processed Singhateh's initial job application but failed to discover his arrest for soliciting a prostitute. Finally, plaintiffs sued Intercontinental for negligent training and supervision of LHI employees. The trial court dismissed, with prejudice, the premises liability counts and also the counts related to negligent hiring and retention and negligent training and supervision under section 2-615 of the Code of Civil Procedure (Code) ( 735 ILCS 5/2-615 (2012) ), leaving the unrepresented alleged perpetrator as the lone defendant. Plaintiffs filed the present interlocutory appeal after the trial court held that there was no just reason to delay an appeal of its order under Illinois Supreme Court Rule 304(a) (eff. Mar. 8, 2016).

¶ 3 For the reasons to follow, we reverse and remand the dismissal of the premises liability counts in plaintiffs' fourth-amended complaint that were directed at LHI, Lakhani, and Gilani. We agree with plaintiffs, *254 finding that they adequately pleaded the existence of a special relationship duty of care between LHI and its employees as the innkeeper and Karla as the guest, and contrary to the trial court's finding, we find that plaintiffs adequately alleged that Singhateh's sexual assault was reasonably foreseeable under both the duty and causation elements of negligence. We affirm the trial court's dismissal of the counts directed at Intercontinental and Hostmark, as none of those defendants were alleged to be a possessor of the premises, and they had no ability or authority to control any activities of LHI's employees. Thus, they owed no duty of care to plaintiffs under these circumstances.

¶ 4 BACKGROUND

¶ 5 Singhateh was hired as a security guard at an O'Hare Holiday Inn in 2004. The following year, LHI purchased both the O'Hare Holiday Inn and the Skokie Holiday Inn, with Intercontinental serving as the franchisor. Singhateh became an LHI employee as a result of the sale and worked at both hotels.

¶ 6 Plaintiffs' first four complaints at law were dismissed with leave to amend. The trial court's dismissal of plaintiffs' fourth-amended complaint is the subject of this appeal. The following operative facts are taken directly from plaintiffs' complaint. Karla alleged that she was a guest at the Skokie Holiday Inn and that she had a drink at the hotel's Bar Louie restaurant/lounge. During that time, she alleged that, unbeknownst to her, Singhateh placed a narcotic substance in her drink. Singhateh, as a hotel security guard, had a key to Karla's room. On the evening in question, Singhateh was directed by another LHI employee to enter Karla's room alone, allegedly in order to repair a faulty air conditioner unit, even though LHI had been advised that Karla was intoxicated. The limited key card records show that "a duplicate key" was used to access Karla's room at 9:40 p.m. Once there, Singhateh raped Karla while she was unconscious. When Karla awoke, she realized that she had been sexually assaulted. A rape kit was taken the next morning at a nearby hospital, and police matched fluid to Singhateh's DNA at a subsequent date. Meanwhile, for reasons that are not disclosed in plaintiffs' complaint or the parties' briefs, Singhateh continued to work for LHI for several years after this occurrence.

¶ 7 Plaintiffs' complaint made numerous allegations about unseemly conduct by Singhateh and others at the Skokie Holiday Inn. Plaintiffs alleged that Singhateh had previously been arrested for solicitation of prostitution after offering an undercover police officer $10 for sexual relations. There was no indication that LHI was aware of that arrest, although the hotel was allegedly aware of another named employee's embezzlement of LHI funds, which was reported to police. In spite of this, LHI also continued to employ this employee. According to plaintiffs, prior to the incident in this case, several named LHI guests filed police reports of stolen property from their rooms, with the key card history of one guest showing that only LHI employees had accessed his room. Plaintiffs also alleged that employees often brought women into the hotel and gave them alcoholic beverages and fraternized with them in a hotel room. Prostitutes were alleged to have frequented the hotel and were served alcohol at the bar. These hotel employees also disabled surveillance cameras, presumably for improper purposes. In April 2011, an unnamed guest called the police department reporting a sexual assault (this allegation lacked further details). In December 2013, just two months after Karla's rape, another unnamed LHI guest allegedly had several drinks at the bar, then was approached *255 by two males, only to later awake in her hotel room naked, and although she did not remember certain portions of the evening, she recalled one male on top of her having intercourse. She reported this rape to the Skokie police.

¶ 8 Additionally, Singhateh was allegedly known by management to have harassed managers and was seen searching their bags without consent. Some six years before this occurrence, plaintiffs alleged that Singhateh was working at the O'Hare Holiday Inn during which time a female guest complained about creepy behavior by the security guard, which included him contacting her at her hotel room via the hotel telephone, even though she had not given this security guard her name or room number. She also said that the same person offered to bring a Caesar salad to her room, even though she had not ordered any food. Finally, she became concerned when she saw a shadow outside her room, leading her to latch and barricade the door. She complained to management that she was concerned for her physical safety and that of other hotel guests based on the interaction. Although Singhateh was not identified by name, the resulting report was placed in his LHI file, implying that management knew that the guest was talking about Singhateh.

¶ 9 In response to these allegations, the trial court ruled that the hotel and its management employees could not have reasonably foreseen that their security guard (who doubled as a handyman) might sexually assault an intoxicated female guest if granted access to her room. Finding that plaintiffs' allegations "continue to lack relevant facts to support the foreseeability of [the] attack," primarily because none of the "additional incidents" alleged by plaintiffs included "a sexual assault by Singhateh or another employee of a hotel guest in her room," the court thereby relieved defendants of any duty to protect Karla from the security guard's criminal activities. The court likewise found that neither Karla's intoxication nor Singhateh's arrest provided a basis for foreseeability. Thus, in dismissing the premises liability counts, the trial court accepted defendants' argument that they had no duty to foresee that Singhateh might rape Karla since they had not known him to have done that previously and that plaintiffs failed to sufficiently plead causation. As stated, the court determined that the counts related to negligent hiring and retention, and also to negligent supervision and training against Intercontinental and Hostmark, should be dismissed because there was no nexus between Singhateh's alleged unfitness due to his arrest and the sexual assault of Karla. Plaintiffs appealed.

¶ 10 ANALYSIS

¶ 11 Plaintiffs now challenge the trial court's judgment. The question presented by a motion to dismiss a complaint under section 2-615 of the Code is whether the complaint alleges sufficient facts that, if proved, would entitle the plaintiff to relief. Bogenberger v. Pi Kappa Alpha Corp. , 2018 IL 120951 , ¶ 23, 423 Ill.Dec. 21 , 104 N.E.3d 1110 . Such a motion challenges only the legal sufficiency of the complaint. Id. We accept all well pleaded facts and reasonable inferences from the facts in a light most favorable to the plaintiff, with the critical inquiry being whether the allegations are sufficient to state a cause of action on which relief can be granted. Id. ; Marshall v. Burger King Corp. , 222 Ill. 2d 422 , 429, 305 Ill.Dec. 897 , 856 N.E.2d 1048 (2006). A court should only dismiss a complaint under section 2-615 where no set of facts can be proved, which would entitle the plaintiff to recovery. Marshall , 222 Ill. 2d at 429 , 305 Ill.Dec. 897 , 856 N.E.2d 1048 . In other words, if the pleadings put at issue one or more facts material to *256 recovery under a claim, evidence must be taken to resolve such issues, and judgment dismissing that claim on the pleadings is inappropriate. Platson v. NSM, America, Inc. , 322 Ill. App. 3d 138 , 143, 255 Ill.Dec. 208 , 748 N.E.2d 1278 (2001). A claim need only show a possibility of recovery, not an absolute right to recovery, to survive a section 2-615 motion. Id. Our review is de novo . Id. at 144, 255 Ill.Dec. 208 , 748 N.E.2d 1278 .

¶ 12 Premises Liability Against LHI, Lakhani, and Gilani

¶ 13 Plaintiffs first contend that they alleged sufficient facts to establish premises liability negligence in that the defendants LHI, Lakhani, and Gilani 1 (1) failed to ensure the safety of their guests generally and also via policy and procedure, (2) improperly gave Singhateh a key to Karla's room and instructed him to fix the air conditioner despite being informed that she was demonstrably intoxicated, (3) failed to perform background checks on their employees, (4) failed to provide adequate security personnel and security cameras, and (5) failed to keep track of the rooms' key cards. Plaintiffs also challenge the dismissal of the associated loss of consortium claims.

¶ 14 In an action like the present, where the plaintiff seeks recovery based on the defendant's alleged negligence, the plaintiff must plead and prove the existence of a duty owed by the defendant, a breach of that duty, and injury proximately resulting from that breach. Bogenberger , 2018 IL 120951 , ¶ 21, --- Ill.Dec. ----, --- N.E.3d ----. We begin our analysis with a discussion of duty. The touchstone of the duty analysis is to ask whether the plaintiff and the defendant stood in such a relationship to one another that the law imposes on the defendant an obligation of reasonable conduct for the benefit of the plaintiff. Krywin v. Chicago Transit Authority , 238 Ill. 2d 215 , 226, 345 Ill.Dec. 1 , 938 N.E.2d 440 (2010). Whether a duty exists is a question of law for the court to decide subject to our de novo review, and thus to determine whether dismissal was proper, we must examine whether the plaintiff alleged sufficient facts, which if proven, establish a duty of care owed to them by defendants. Id. ; Doe-3 v. McLean County Unit District No. 5 Board of Directors , 2012 IL 112479 , ¶ 20, 362 Ill.Dec. 484 , 973 N.E.2d 880 . On the other hand, questions of a breach of the duty and proximate cause of the injury are factual matters for the jury to decide, provided there is a genuine issue of material fact regarding those issues. Krywin , 238 Ill. 2d at 226 , 345 Ill.Dec. 1 , 938 N.E.2d 440 ; Marshall , 222 Ill. 2d at 430 , 305 Ill.Dec. 897 , 856 N.E.2d 1048 .

¶ 15 Plaintiffs contend that they adequately pleaded the existence of a special relationship between the hotel and Karla, such that the hotel had a duty to protect her against the criminal actions of a third party, including the hotel's own employee. While generally speaking, the owner or possessor of property does not owe a duty to protect invitees from the criminal acts of third parties, however, a notable exception to this is if a special relationship exists between the parties, *257 such as, in this case, an innkeeper and its guests, a common carrier and its passengers, a voluntary custodian and ward, or a business invitor and invitee. Iseberg v. Gross , 227 Ill. 2d 78 , 88, 316 Ill.Dec. 211 , 879 N.E.2d 278 (2007) ; see also Restatement (Second) of Torts § 314A (1965). As section 314A of the Restatement (Second) of Torts puts it,

"A[n] [innkeeper] is under a duty to its [guests] to take reasonable action

(a) to protect them against unreasonable risk of physical harm, and

(b) to give them first aid after it knows or has reason to know that they are ill or injured, and to care for them until they can be cared for by others." Restatement (Second) of Torts § 314A, at 118 (1965).

The duty to protect against unreasonable risk of harm extends to risks arising from acts of third persons, whether innocent, negligent, intentional, or even criminal. Restatement (Second) of Torts § 314A cmt. d, at 119 (1965). Likewise, before duty can attach, a defendant must know or should know of the unreasonable risk of injury. Restatement (Second) of Torts § 314A cmt. f, at 120 (1965). This is another way of saying that the defendant must know of the chance of injury or the possibility of harm. See Black's Law Dictionary (10th ed. 2014) (defining "risk"). Pertinent to this case, the Restatement (Second) of Torts § 319 (1965) 2 also states that when one actor (like the hotel) takes charge of a third person (like a hotel employee) "whom he knows or should know" would likely cause bodily harm to another (like Karla) if not controlled, that actor "is under a duty to exercise reasonable care to control the third person [like the employee] to prevent him from doing such harm." 3

¶ 16 Courts have historically held that a hotel or common carrier, for example, must exercise the "highest degree of care," which we interpret simply as another way of expressing the existence of a special relationship. 4 See *258 Krywin , 238 Ill. 2d at 226 , 345 Ill.Dec. 1 , 938 N.E.2d 440 ; Danile v. Oak Park Arms Hotel, Inc. , 55 Ill. App. 2d 2 , 3, 9, 203 N.E.2d 706 (1964) ("a reasonable degree of care is a high degree of care"); Fortney v. Hotel Rancroft, Inc. , 5 Ill. App. 2d 327 , 335, 125 N.E.2d 544 (1955). These special relationships give rise to an affirmative duty to aid or protect another against an "unreasonable risk of physical harm." Simpkins , 2012 IL 110662 , ¶ 20, 358 Ill.Dec. 613 , 965 N.E.2d 1092 . Such duties are premised on a relationship between the parties that is independent of the specific situation which gave rise to the harm. Restatement (Second) of Torts § 314A cmt. b, at 119 (1965) (the "special relations between the parties * * * create a special responsibility, and take the case out of the general rule"); see also Bogenberger , 2018 IL 120951 , ¶ 33, 423 Ill.Dec. 21 , 104 N.E.3d 1110 . The key to imposing a duty based on a special relationship is that the defendant's relationship with either the tortfeasor or the plaintiff " 'places the defendant in the best position to protect against the risk of harm.' " Bogenberger , 2018 IL 120951 , ¶ 39, 423 Ill.Dec. 21 , 104 N.E.3d 1110 (quoting Grand Aerie Fraternal Order of Eagles v. Carneyhan , 169 S.W.3d 840 , 850 (Ky. 2005) ). With respect to the innkeeper-guest relationship, it has been said that "since the ability of one of the parties to provide for his own protection has been limited in some way by his submission to the control of the other, a duty should be imposed upon the one possessing control (and thus the power to act) to take reasonable precautions to protect the other one from assaults by third parties which, at least, could reasonably have been anticipated." (Internal quotation marks omitted.) Hills v. Bridgeview Little League Ass'n , 195 Ill. 2d 210 , 244, 253 Ill.Dec. 632 , 745 N.E.2d 1166 (2000).

¶ 17 Whether the rape in this case could have been reasonably anticipated by LHI and its employees, and was thus foreseeable, forms the crux of the parties' contentions on appeal. See Bruns v. City of Centralia , 2014 IL 116998 , ¶ 33, 386 Ill.Dec. 765 , 21 N.E.3d 684 ("something is foreseeable only if it is objectively reasonable to expect" (internal quotation marks omitted) ). Plaintiffs assert that defendants created a "dangerous condition" by allowing Singhateh unfettered access to Karla's room while she was intoxicated and, in fact, directing him to the room, especially given Singhateh's background and the hotel's licentious atmosphere. They thus argue that a subsequent crime was generally foreseeable. The defendants argue contrarily that prior instances of criminal conduct must be similar in nature for foreseeability purposes. They specifically argue that there were no reported sexual assaults by Singhateh or other LHI employees, *259 thus militating against a finding of foreseeability under the duty element.

¶ 18 To understand foreseeability as it relates to a special relationship duty of care at the pleading stage, we turn to Illinois Supreme Court law. In the seminal special duty case of Marshall , a Burger King customer was eating in the restaurant when Pamela Fritz lost control of her car in the parking lot, rendering it airborne, before it crashed into the building and killed the customer. The trial court dismissed the case on a section 2-615 motion after finding no duty because the type of accident was unlikely and the burden to protect against the accident was onerous. The supreme court disagreed and affirmed the appellate court's reversal and remand of the case.

¶ 19 The supreme court held that due to the business invitor-invitee special relationship, the defendants, as owners and operators of the restaurant, owed an affirmative duty to the deceased customer to protect against the third-party negligent driving of Fritz. They specifically reasoned that the duty to protect arose out of the special relationship of the parties, noting that this special relationship and duty of care encompassed "the type of risk- i.e. , the negligent act of a third person-" that led to the customer's injury. Marshall , 222 Ill. 2d at 440 , 305 Ill.Dec. 897 , 856 N.E.2d 1048 . While noting that the existence of duty turns in large part on public policy considerations, the court reasoned that "the policy justifying the business invitor's duty of reasonable care is related to the affirmative action the invitor takes in opening his business to the public and to the potential for harm that a business open to the general public poses." Id. at 441, 305 Ill.Dec. 897 , 856 N.E.2d 1048 .

¶ 20 Marshall then analyzed whether the defendants had shown that they were entitled to an exemption from the duty of protection. In doing so, the court examined the traditional four policy factors associated with "duty," including the reasonable foreseeability of the injury, the injury's likelihood, the burden of guarding against the injury, and the consequences of placing the burden on the defendant, before concluding that the defendants had not rebutted the existence of a duty to protect. 5 The court declined to fully address whether the business invitor's lack of knowledge of prior, similar incidents of negligent conduct, should limit his duty of care, finding the defendants' argument in that regard underdeveloped. Most pertinent to our analysis here is that the court also specifically found it unpersuasive that a defendant must have some notice of a prior incident or prior conduct before the law imposes a duty to protect a plaintiff from the conduct of a third party, or that the prior incident must be sufficiently similar to put a defendant on notice that there is a reasonable probability that the acts of the third party are likely to cause physical harm to others.

*260 Id. at 444-45, 305 Ill.Dec. 897 , 856 N.E.2d 1048 (citing Restatement (Second) of Torts § 344 cmt. f (1965) ). Marshall thus held that a special relationship, standing alone, was sufficient to establish an affirmative duty to protect against third-party negligence.

¶ 21 Other supreme court cases (both before and after Marshall ), appear to require foreseeability 6 as an inherent requirement in proving a special relationship duty to protect. In Iseberg , 227 Ill. 2d 78 , 316 Ill.Dec. 211 , 879 N.E.2d 278 , a section 2-615 case decided in 2007, a year after Marshall and where no special relationship was found, the court stated that when one of the four special relationships "exists between the parties and an unreasonable risk of physical harm arises within the scope of that relationship, an obligation may be imposed on the one to exercise reasonable care to protect the other from such risk, if the risk is reasonably foreseeable , or to render first aid when it is known that such aid is needed." (Emphasis added.) Id. at 88, 316 Ill.Dec. 211 , 879 N.E.2d 278 . This echoed an earlier statement in Hills (decided in 2000) that, "[t]he existence of a special relationship does not, by itself, impose a duty upon the possessor of land to protect lawful entrants from the criminal acts of third parties. Before a duty to protect will be imposed it must also be shown that the criminal attack was reasonably foreseeable." Hills , 195 Ill. 2d at 243 , 253 Ill.Dec. 632 , 745 N.E.2d 1166 . Likewise, the supreme court had long held in the common carrier-passenger case of Letsos v. Chicago Transit Authority , 47 Ill. 2d 437 , 441, 265 N.E.2d 650 (1970), that the carrier's high degree of care it owed to passengers included, "the responsibility to prevent injuries which could have been reasonably foreseen and avoided by the carrier." We find Marshall particularly apt in this case, since as in Marshall , this case involves a special relationship complaint dismissed at the section 2-615 stage. We thus proceed in our analysis pursuant to Marshall . It merits mention, however, that whether foreseeability is a rebuttable contention on defendants' part or a requirement under a special relationship duty element, plaintiffs have adequately set forth a cause of action, which requires reversal of the trial court's judgment.

¶ 22 Here, as in Marshall , due to the hotel-guest special relationship pleaded in this case, defendants owed an affirmative duty to Karla to protect against third-party criminal attacks. Restatement (Second) of Torts § 314A cmt. d, at 119 (1965). This type of relationship encompassed the type of risk, a sexual assault by a hotel employee. Plaintiffs' complaint specifically alleged that while Karla was a paying guest at a hotel owned, operated, and managed by defendants, she was rendered intoxicated by defendants' employee and then sexually assaulted by him in her room. LHI's hotel management essentially facilitated the assault by sending this male security guard/repairman into that room, knowing that he had a key, despite being forewarned that the female guest was intoxicated. We observe that to "safely" commit his crime, Singhateh needed to be in Karla's room, alone with her, behind the locked door. Rather than affirmatively protecting her privacy and safety in her locked room, the hotel management vitiated it. See Restatement (Second) of Torts § 314A cmt. d, at 119 (1965). ("[t]he duty to protect the other against unreasonable risk of harm extends to risks arising out of the actor's own conduct"). In other words, the allegations establish that LHI and its management should have known that Singhateh *261 could have entered Karla's room without her consent and then taken advantage of her.

"A guest, who is either asleep in [her] room or about to enter [her] room, should not be subjected to the risk of an assault * * *. A guest has a right to rely upon the innkeeper doing all within his power to avoid or prevent such an assault, and to that end should be required to exercise a high degree of care." Fortney , 5 Ill. App. 2d at 335 , 125 N.E.2d 544 .

¶ 23 In this case, at this early stage in the pleadings, foreseeability, or defendants' quality of being able to reasonably anticipate the risk of physical harm, was satisfied by conferring on the parties their special relationship of hotel-guest. With that special relationship, according to Marshall , it was incumbent on defendants to show the existence of an exemption under the traditional four duty factors identified above. Given the pervasiveness of sexual assaults and generalized crimes in hotels, it is reasonably foreseeable that hotel guests will from time to time be at such risk in hotels. See Marshall , 222 Ill. 2d at 442 , 305 Ill.Dec. 897 , 856 N.E.2d 1048 ; see also Fortney , 5 Ill. App. 2d 327 , 125 N.E.2d 544 (battery in hotel room); Danile , 55 Ill. App. 2d 2 , 203 N.E.2d 706 (rape in hotel room); Mrzlak , 25 Ill. App. 3d 706 , 323 N.E.2d 796 (rape in hotel room); Yamada , 60 Ill. App. 3d 101 , 17 Ill.Dec. 228 , 376 N.E.2d 227 (murder and sexual assault/battery in hotel room); see also Kukla v. Syfus Leasing Corp. , 928 F.Supp. 1328 (S.D.N.Y. 1996) ; Allen v. Ramada Inn, Inc. , 778 P.2d 291 (Colo. App. 1989) ; Nebel v. Avichal Enterprises, Inc. , 704 F.Supp. 570 (D.N.J. 1989) ; Millman v. Howard Johnson's Co. , 533 So.2d 901 (Fla. Dist. Ct. App. 1988) ; Margreiter v. New Hotel Monteleone, Inc. , 640 F.2d 508 (5th Cir. 1981) ; Rosier v. Gainesville Inns Associates, Ltd. , 347 So.2d 1100 (Fla. Dist. Ct. App. 1977) (all involving rape, battery, or other crimes in a hotel room); cf. Bogenberger , 2018 IL 120951 , ¶ 46, 423 Ill.Dec. 21 , 104 N.E.3d 1110 (noting, "an injury is not reasonably foreseeable where it results from freakish, bizarre, or fantastic circumstances" (internal quotation marks omitted) ). As Marshall stated, "what is required to be foreseeable is the general character of the event or harm * * * not its precise nature or manner of occurrence." (Internal quotation marks omitted.) Marshall , 222 Ill. 2d at 442 , 305 Ill.Dec. 897 , 856 N.E.2d 1048 . Likewise, the likelihood of injury resulting from criminal acts is quite high, as set forth above. Finally, the burden of guarding against such harm is minimal, as hotels could simply impose procedures for when guests appear incapacitated, safely manage questionable employees, or practice sending several employees of varying genders at a time to guests' rooms. In other words, a number of simple, thoughtful protections may be instituted to guard against attacks on guests. Plaintiffs, thus, adequately alleged a special relationship in this case sufficient to establish duty.

¶ 24 In reaching our conclusion, we thus reject defendants' claim that because no previous crime of this exact nature in the hotel had been pled in detail (although another LHI guest rape was pled to have occurred a mere two months after Karla's alleged rape), they should be relieved of their duty to protect Karla. Relying on Salazar v. Crown Enterprises, Inc. , 328 Ill. App. 3d 735 , 262 Ill.Dec. 906 , 767 N.E.2d 366 (2002), defendants argue that Singhateh's actions were unforeseeable and that defendants could not have been on notice of his specific crime. Salazar involved a homeless man, who as a trespasser, entered a vacant building that had been the site of disrepair and lawlessness, and he was subsequently murdered.

*262 Id. at 737, 262 Ill.Dec. 906 , 767 N.E.2d 366 . The Salazar court concluded that there was no special relationship to impose a duty on the defendant building owners to protect trespassers from third-party attacks and added that while the plaintiff had alleged that numerous crimes occurred on the property, none involved murder. Id. at 744-45, 262 Ill.Dec. 906 , 767 N.E.2d 366 . We find defendants' reliance on Salazar singularly misplaced since there was no special relationship at issue there and since we have analyzed foreseeability as a matter of law under Marshall .

¶ 25 We find Danile and plaintiffs' reliance on Mrzlak , both special relationship hotel cases, more appropriate. See Rowe v. State Bank of Lombard , 125 Ill. 2d 203 , 215-216, 126 Ill.Dec. 519 , 531 N.E.2d 1358 (1988) (in the course of recognizing the special relationship between innkeeper and guest, Rowe specifically relied on Danile and Mrzlak ). In Danile , 55 Ill. App. 2d 2 , 203 N.E.2d 706 , the plaintiff was sleeping in her hotel room after socializing with her fiancé and his mother when she was raped at 5 a.m. by a bellboy, an employee of the defendant hotel who had become intoxicated after drinking in another guest's room. He took the victim's "pass key from a ring on a hook" behind the lobby desk, where a switchboard operator and a night desk man were on duty. Id. at 4-5, 203 N.E.2d 706 . After the plaintiff received a $25,000 judgment, the hotel appealed, arguing that it had "no previous knowledge of misconduct" by its employee and that nobody knew that he was drinking. Id. at 5, 203 N.E.2d 706 . The hotel complained that its drunken employee was "on a lark of his own." Id. at 7, 203 N.E.2d 706 . In upholding the verdict in favor of the plaintiff, the court stated the jury could reasonably find that the hotel staff "could have and should have known of [the bellboy's] absence from his post when he was upstairs drinking and they should have found out where he was," and that they should have guarded the key more carefully. Id. at 6, 203 N.E.2d 706 . The court thus held that it was not necessary that the hotel have notice of prior instances of similar conduct by the errant bellboy and, in essence, concluded that foreseeability was subsumed by the hotel-guest relationship.

¶ 26 In Mrzlak , 25 Ill. App. 3d 706 , 323 N.E.2d 796 , the plaintiff was asleep in her room at the Dearborn Club Residence for Girls (Dearborn Club) when she was assaulted and robbed by an unknown male who entered her second-floor room through the bathroom window. The defendants appealed, arguing, inter alia , that they owed no duty to the plaintiff because the assault by the third party was not reasonably foreseeable. Id. at 709, 323 N.E.2d 796 . As to the issue of duty, the defendants argued against foreseeability because there were no previous incidents, a claim which the court summarily rebuffed, citing evidence of nearby taverns and a rooming house, along with proof of several attempted break-ins at the defendants' club residence of which the co-owners were aware. Id. at 709-10, 323 N.E.2d 796 . Thus, the Mrzlak court held the Dearborn Club liable in light of the club's notice of other crimes in the area, even though the crimes did not involve assault. Id. at 710, 323 N.E.2d 796 . The court likewise held that, in light of the evidence, "foreseeability was properly a question for the jury" and declined to overturn the jury's decision on appeal. Id.

¶ 27 We also find Virginia D. v. Madesco Investment Corp. , 648 S.W.2d 881 (Mo. 1983) ( en banc ), persuasive. There, the trial court entered a judgment notwithstanding the verdict for the defendant after the plaintiff prevailed in her claim against a hotel. The plaintiff claimed that she was meeting friends for drinks, only to be raped in the hotel bathroom by an *263 intruder. The trial court's decision was based on its belief that the hotel could not have reasonably foreseen this assault. The Missouri Supreme Court reversed, finding that the "question [of] whether the defendant exercised the proper degree of care under the circumstances, and the question of causation, were issues to be decided by the jury and should not have been preempted by the court." Id. at 889 . Evidence at trial indicated that the hotel (not unlike the Skokie Holiday Inn) was a den of iniquity, plagued with criminal elements, such as prostitutes, thieves, and vagrants, but that there was no proof of a prior sexual assault. The defendant argued that the lack of a prior sexual assault alone precluded liability, both as to the lack of a duty and the lack of foreseeability. The Missouri Supreme Court was blunt in its disagreement, stating, "[t]here is no requirement that there be at least one mugging or rape before the innkeeper is obliged to consider the possibility." Id. at 887 .

¶ 28 We likewise decline to impose the equivalent of a "one free rape rule" 7 since there is simply no requirement under Illinois law that an innkeeper be on notice of a prior sexual assault before any duty to protect would arise for a third-party attack of that nature. See Isaacs v. Huntington Memorial Hospital , 38 Cal.3d 112 , 211 Cal.Rptr. 356 , 695 P.2d 653 , 658 (1985) (noting, "Surely, a landowner should not get one free assault before he can be held liable for criminal acts which occur on his property."); see also William L. Prosser, Handbook of the Law of Torts § 70, at 465 (4th ed. 1971) (vicarious liability is imposed even for such entirely personal torts as rape and applied to innkeepers). If we were to impose such a "notice" rule, it would produce the inimical result of the first sexual assault victim lacking a civil claim, while allowing the next victim (like the one allegedly so assaulted two months later in defendants' hotel while Singhateh was still employed) to receive justice because defendants had notice of the prior rape. 8 See Isaacs , 211 Cal.Rptr. 356 , 695 P.2d at 658 . Any such holding would lead to arbitrary results and would surely be against public policy. See Marshall , 222 Ill. 2d at 441 , 305 Ill.Dec. 897 , 856 N.E.2d 1048 (noting, duty is not "sacrosanct in itself, but is only an expression of the sum total of those considerations of policy which lead the law to say that the plaintiff is entitled to protection" (internal quotation marks omitted) ). The "notice" analysis in Marshall , discussed supra , also suggests this much. We further observe that a strict notice requirement improperly conflates foreseeability of a particular act with previous occurrences of similar acts, which Marshall has already rejected in the context *264 of special relationship cases, requiring that only the general character of the event or harm be foreseeable. See id. at 442, 305 Ill.Dec. 897 , 856 N.E.2d 1048 .

¶ 29 While we decline to impose a strict notice requirement for the duty element in this special relationship case at the pleading stage, we observe that plaintiffs, nonetheless, did adequately plead constructive notice. Cf. Comastro v. Village of Rosemont , 122 Ill. App. 3d 405 , 409, 78 Ill.Dec. 32 , 461 N.E.2d 616 (1984) (a summary judgment case requiring notice). This supports the foreseeability of the risk of harm to Karla both as a matter of law and fact and, moreover, that the allegations were sufficient to state a cause of action. In plaintiffs' complaint, for example, they identified several incidents where items were stolen from other LHI guests' rooms while those guests were elsewhere, and in addition, the pertinent records involving the use of key cards to enter at least one of these guests' rooms showed that only hotel personnel had access to the rooms. Singhateh himself had a prior arrest, damaging reports in his personnel file with respect to another female hotel guest, and had previously harassed managers, searching their bags absent consent. The hotel, additionally, condoned a licentious atmosphere which included drugs, prostitution, and disabling of security cameras. As in Danile, Mrzlak , and Virginia D. , the crime that Singhateh is alleged to have committed was thus foreseeable, notwithstanding the absence of specific facts showing that either Singhateh or another LHI employee had previously committed a sexual assault against another guest. Likewise, as in Mrzlak , we believe that the evidence showing the hotel's extent of knowledge about the character of its particular hotel, including its location and employees, and previous crimes committed in the hotel, as well as any precautionary measures taken, all involved a question of foreseeability for the jury's consideration under both a fleshed-out negligence duty element and causation element analysis. See also id. (noting "[w]hat precautions are reasonable is a question for the trier of fact").

¶ 30 The following cases buttress our conclusion that the hotel was under a duty to protect a vulnerable, drugged guest from injury. In Kigin v. Woodmen of the World Insurance Co. , 185 Ill. App. 3d 400 , 401-02, 133 Ill.Dec. 524 , 541 N.E.2d 735 (1989), the mother of a 15-year-old camper sued Woodmen of the World Insurance Company, who operated a camp at which a 41-year-old counselor gave the minor alcohol, groped her, and attempted to have sexual intercourse with her. After the trial court dismissed the plaintiff's complaint, our Fifth District appellate court reversed. Id. at 404, 133 Ill.Dec. 524 , 541 N.E.2d 735 . The Kigin court focused on the factual allegations in the complaint that the camp counselor was in managerial authority, as he gave the young girl alcohol while becoming intoxicated himself. Id. at 402, 133 Ill.Dec. 524 , 541 N.E.2d 735 . Despite this knowledge, the supervisor allowed the camp counselor to go off with the minor to a remote location, an action which the court called, "a formula for disaster." Id. at 403, 133 Ill.Dec. 524 , 541 N.E.2d 735 .

¶ 31 Similarly, in Platson , 322 Ill. App. 3d 138 , 140-41, 255 Ill.Dec. 208 , 748 N.E.2d 1278 , our Second District appellate court reversed the trial court's dismissal of a lawsuit alleging that an employer was liable for the inappropriate sexual behavior of its employee by virtue of his repeatedly massaging the shoulders of a 16-year-old employee in full view of supervisors and other employees. Ultimately, the supervisor scheduled the plaintiff to work alone with him one evening when he forced himself on her. Id. at 141-42, 255 Ill.Dec. 208 , 748 N.E.2d 1278 . Relevant to this appeal, *265 part of the Platson court's analysis focused on the "special relationship" doctrine stemming from section 314 of the Restatement (Second) of Torts, ultimately holding that the dismissal of the complaint was improper because the plaintiff adequately pled a special relationship by virtue of it having a "custodial relationship" with the plaintiff. Id. at 149, 255 Ill.Dec. 208 , 748 N.E.2d 1278 .

¶ 32 In Anicich v. Home Depot U.S.A., Inc. , 852 F.3d 643 (7th Cir. 2017), a 22-year-old woman had worked part-time in the flower department at a Home Depot store for a number of years. Throughout her tenure, she was consistently sexually harassed and demeaned by her supervisor who was known to harass other female employees. Id. at 646 . He was sent to anger management treatment, which he failed to complete. Id. at 647 . He required the young woman to accompany him on business trips and once insisted that they share a room. Id. Then, he insisted that she accompany him to a family wedding in Wisconsin. Id. at 648 . He threatened to cut her hours if she declined and offered to pay her overtime if she went. After the wedding, in their room (where he allegedly insisted that she stay with him), he attempted to have sexual relations with her. She was six months pregnant. After she rebuffed his advances, he strangled her to death and raped her pregnant corpse. Id. The trial court dismissed the plaintiff's complaint, finding that Home Depot and its subcontractor owed no duty to the decedent. Id.

¶ 33 The Seventh Circuit Court of Appeals reversed, holding that under the factual circumstances, the defendants owed the decedent a duty of care to protect her from her supervisor, who was known to be abusive. After discussing the federal statutes that could impose liability for failing to discipline those harassing employees, the court examined Illinois law regarding liability for negligent hiring, supervision, or retention and held that, pursuant to the Restatement (Second) of Torts § 317(a) (1965), it believed that the Illinois Supreme Court would find that a tortfeasor's use of supervisory authority would provide a basis for employer liability, even though the crime occurred off-premises. Most pertinent to our resolution of this case, the Anicich court examined the question of whether an employee's " 'particular unfitness...rendered the plaintiff's injury foreseeable to a person of ordinary prudence in the employer's position.' " Anicich , 852 F.3d at 654 (quoting Van Horne v. Muller , 185 Ill. 2d 299 , 313, 235 Ill.Dec. 715 , 705 N.E.2d 898 (1998) ). Home Depot and its subcontractor argued that Cooper's attacks represented a "radical break" from his earlier, observed behavior so that while the employer might have been able to foresee violence, "they could not have foreseen murder." Id. The court was unmoved, holding that "these sort of arguments present factual issues" that should not be decided on a motion to dismiss.

¶ 34 All of the preceding cases of rape, battery, assault, and murder clearly have many factual variables, but the facts of this case tell an all-too-familiar tale where a vulnerable woman is raped and the assault is enabled by the failure of a responsible party to protect the victim. Plaintiffs deserve the opportunity to expand on their story beyond the pleading stage, and the trial court erred in dismissing the counts of plaintiffs' complaint against the owner, operator, and manager of the hotel and its involved employees.

¶ 35 Proximate Causation and Foreseeability of Injury

¶ 36 Having found duty, we also reject the trial court's conclusion that plaintiffs failed to plead proximate cause. As stated, whether there was a breach of *266 the duty and whether the breach was the proximate cause of the injury are both matters for the jury. Thompson v. Gordon , 241 Ill. 2d 428 , 438-39, 349 Ill.Dec. 936 , 948 N.E.2d 39 (2011). "What constitutes proximate cause has been defined in numerous decisions, and there is practically no difference of opinion as to what the rule is. The injury must be the natural and probable result of the negligent act or omission and be of such a character as an ordinarily prudent person ought to have foreseen as likely to occur as a result of the negligence, although it is not essential that the person charged with negligence should have foreseen the precise injury which resulted from his act ." (Emphasis added.) Neering , 383 Ill. at 380, 50 N.E.2d 497 . The preceding language from Neering was later cited in the seminal case of Ney v. Yellow Cab Co. , 2 Ill. 2d 74 , 79, 117 N.E.2d 74 (1954), which involved an automobile crash in which a thief stole a cab that was left with the key in the ignition and the engine running and later struck another car, causing property damage.

¶ 37 For the reasons elucidated at some length above, plaintiffs have adequately pleaded that defendants ought to have foreseen that their security guard/handyman might commit an offense against this incapacitated woman once he gained private and protected access to her hotel room. See also Fenton v. City of Chicago , 2013 IL App (1st) 111596 , ¶ 31, 368 Ill.Dec. 349 , 984 N.E.2d 74 ("the possibility that this drunken, angry young man whose conduct had twice required police intervention might return to the residence and act in a violent manner strikes us as probable and very likely"); Rivera v. Garcia , 401 Ill. App. 3d 602 , 615, 340 Ill.Dec. 224 , 927 N.E.2d 1235 (2010) (holding there was overwhelming evidence that provided a clear nexus between the wilful and wanton conduct of the police officers in initiating the pursuit to the shooting injury to one occupant and the death of the other). There is simply no legal requirement that they would necessarily have to foresee the specific way in which he would offend their hotel guest, so their conduct presents a factual issue related to proximate cause for the jury to decide, not by a judge in a motion to dismiss.

¶ 38 Premises Liability Against Intercontinental

¶ 39 As for Intercontinental, we agree with the trial court's ruling that the allegations do not support premises liability. In asserting liability, plaintiffs rely on the principle that an innkeeper has a duty to protect against the injurious acts of third persons. Yet, plaintiffs on appeal have not developed any argument, with citation to legal authority, showing that Intercontinental, a franchisor, constitutes an innkeeper or that LHI's status as an innkeeper could be imputed to Intercontinental. See Ill. S. Ct. R. 341(h)(7) (eff. July 1, 2017) (an appellant must set forth contentions on appeal and the reasons therefore, with citation to the authorities and the pages of the record relied on).

¶ 40 Regardless, consistent with Intercontinental's argument, we note that it is well-established in Illinois that no special relationship exists between a franchisor and a franchisee's invitee. C.H. v. Pla-Fit Franchise, LLC , 2017 IL App (3d) 160378 , ¶ 29, 416 Ill.Dec. 135 , 83 N.E.3d 633 ; see also Kennedy v. Western Sizzlin Corp. , 857 So.2d 71 , 77 (Ala. 2003) (noting "[a] franchise agreement, without more, does not make the franchisee an agent of the franchisor"). Intercontinental was not alleged to be a possessor of the hotel, as required, where a land possessor is "a person who is in occupation of the land with intent to control it." (Internal quotation marks omitted.) See *267 C.H. , 2017 IL App (3d) 160378 , ¶ 29, 416 Ill.Dec. 135 , 83 N.E.3d 633 ; Restatement (Second) of Torts § 328E (1965) ; Parmenter v. J & B Enterprises, Inc. , 99 So.3d 207 , 214 (Miss. Ct. App. 2012) (finding that McDonald's Corporation was not the employer of a franchise, where McDonald's Corporation did not own the subject location and did not dictate day-to-day franchise operations or have firing and hiring authority); cf. Marshall , 222 Ill. 2d at 426 , 305 Ill.Dec. 897 , 856 N.E.2d 1048 (there was no similar franchisor-franchisee issue, where the plaintiff alleged that Burger King owned, operated, controlled, and maintained the restaurant by and through its agents, servants, employees, and franchisees). According to plaintiffs' complaint, it was not Intercontinental in control of the hotel but rather LHI, since it owned and operated the hotel. See Madden v. F.H. Paschen/S.N. Nielson, Inc. , 395 Ill. App. 3d 362 , 375, 334 Ill.Dec. 315 , 916 N.E.2d 1203 (2009) (noting for a premises liability claim, it is a prerequisite that the defendant be a possessor of land with intent to control it, as he is in the best position to discover and control its dangers). As there was no special relationship and Intercontinental lacked possessory control over the hotel at issue in this case, Intercontinental cannot be held liable for the criminal acts of LHI's employee, Singhateh. We thus reject plaintiffs' argument in their reply brief that Intercontinental should be barred from asserting the lack of a special relationship here because they raised it for the first time on appeal and that plaintiffs should be given leave to amend this particular premises liability count (count XX). Plaintiffs did not argue to amend their complaint in their initial brief, thus waiving the matter. See Ill. S. Ct. R. 341(h)(7) (eff. July 1, 2017) ("Points not argued are waived and shall not be raised in the reply brief * * *."). Likewise, the burden to prove all elements of a negligence action remains on the plaintiff throughout the proceedings ( Krywin , 238 Ill. 2d at 233 , 345 Ill.Dec. 1 , 938 N.E.2d 440 ), and plaintiffs have had ample opportunity to plead this cause of action. Accordingly, we affirm the dismissal of this claim.

¶ 41 Negligent Hiring and Retention by Intercontinental and Hostmark

¶ 42 Plaintiff also asserts that Hostmark and Intercontinental negligently hired and retained Singhateh. Such an action requires the plaintiff to plead and prove (1) that the employer knew or should have known that the employee had a particular unfitness for the position so as to create a danger of harm to third persons, (2) that such particular unfitness was known or should have been known at the time of the employee's hiring or retention, and (3) that this particular unfitness proximately caused the plaintiff's injury. Van Horne v. Muller , 185 Ill. 2d 299 , 311, 235 Ill.Dec. 715 , 705 N.E.2d 898 (1998).

¶ 43 Here, the complaint alleges that Hostmark negligently hired Singhateh in 2004 because his prior arrest for solicitation of prostitution made him an unfit employee who presented a danger of harm to third persons. We agree with the trial court that there was an insufficient "nexus" between Hostmark's failure to discover Singhateh's earlier mere solicitation arrest and a rape that took place many years later. See Giraldi v. Community Consolidated School District No. 62, 279 Ill. App. 3d 679 , 692, 216 Ill.Dec. 272 , 665 N.E.2d 332 (1996) (no proximate cause injury for negligent hiring against bus company, where company only knew driver was perpetually late in his job prior to driver's sexual assault of child); cf. Malorney v. B&L Motor Freight, Inc. , 146 Ill. App. 3d 265 , 268-69, 100 Ill.Dec. 21 , 496 N.E.2d 1086 (1986) (holding a factual question for the jury existed about whether company negligently hired truck driver with criminal history of violent sex-related crimes *268 who later raped and beat the plaintiff hitchhiker). At the time of Singhateh's hiring, there is no allegation that Hostmark knew of Singhateh's history of threatening anyone's safety or engaging in untoward behavior. Moreover, plaintiffs' complaint alleged that a year later in 2005, LHI became Singhateh's employer. Plaintiffs' complaint did not allege that Hostmark continued to have authority over Singhateh's employment thereafter, and plaintiffs do not otherwise explain on appeal how Hostmark could be held responsible for LHI retaining Singhateh in his position. Accordingly, the court properly dismissed that claim.

¶ 44 Similarly, plaintiffs' complaint failed to state a cause of action for negligent hiring and retention against Intercontinental. We reiterate that plaintiffs' complaint alleged that Hostmark, as opposed to Intercontinental, actually hired Singhateh in 2004 and that LHI subsequently became Singhateh's employer. Plaintiffs' complaint does not, however, specify when Intercontinental became Singhateh's employer, although it does allege that both LHI and Intercontinental "re-hired" Singhateh in 2012 and 2014. It also does not allege any direct communication between LHI and Intercontinental with respect to management of the hotel or its employees. Instead, plaintiffs' complaint appears to assume that the employer status of a franchisee, such as LHI, may be imputed to a franchisor, such as Intercontinental. Yet, plaintiffs have cited no legal authority in support of that proposition. See Ill. S. Ct. R. 341(h)(7) (eff. July 1, 2017). Accordingly, we affirm the trial court's dismissal of plaintiffs' negligent hiring and retention complaint against Intercontinental.

¶ 45 Negligent Training and Supervising by Intercontinental

¶ 46 Finally, plaintiffs have not developed any argument that the court improperly dismissed their claim that Intercontinental was negligent in training and supervising the employees of LHI. See Ill. S. Ct. R. 341(h)(7) (eff. July 1, 2017); Marzouki v. Najar-Marzouki , 2014 IL App (1st) 132841 , ¶ 12, 382 Ill.Dec. 341 , 12 N.E.3d 620 (issues must be clearly defined and supported by pertinent authority and failure to develop an argument results in waiver). Accordingly, that contention is forfeited. See Marzouki , 2014 IL App (1st) 132841 , ¶ 12, 382 Ill.Dec. 341 , 12 N.E.3d 620 .

¶ 47 CONCLUSION

¶ 48 We therefore reverse the trial court's dismissal of the counts of plaintiffs' fourth-amended complaint directed against LHI, Lakhani, and Gilani, including the loss of consortium claims of Dean Gress (counts I to VI) but affirm the dismissal of all counts against Intercontinental and Hostmark (counts XIV to XXI).

¶ 49 Affirmed in part and reversed in part; cause remanded.

Presiding Justice Cobbs and Justice Fitzgerald Smith concurred in the judgment and opinion.