KANNE, Circuit Judge.
Loretta Reynolds alleges that Brenda Russell and Casey Carson induced her to become intoxicated in a bar owned by CB Sports Bar, Inc., and attempted to take her back to their apartment “for sexual exploitation.” Reynolds managed to escape, but was injured when she was struck by a car. Reynolds sued Russell, Carson, and CB Sports for negligence and punitive damages. She alleged in her second amended complaint that CB Sports (through its bartenders) knew of Russell and Carson’s plans but negligently failed to protect her from the attack. The district court dismissed the negligence count against CB Sports for failing to state a claim. Because we conclude that Reynolds’s complaint is broad enough to encompass a viable theory of negligence against CB Sports, we reverse and remand.
[1145]*1145I. Background
In her second amended complaint, Reynolds alleged that in October 2005 she went to Jerzey’s Sports Bar in O’Fallon, Illinois. Jerzey’s is owned by Appellee CB Sports Bar, Inc. After two beers, Reynolds left the bar to go back to her hotel, but discovered that her car would not start. She went back into the bar and asked the bartender for a phone book so that she could call for a taxi. The bartender told her that no taxis were available and that she would have to get a ride back to her hotel from someone in the bar.
Brenda Russell and Casey Carson approached Reynolds and offered to give her a ride to her hotel. Before they left the bar, however, Russell and Carson bought Reynolds several drinks “in an attempt to cause plaintiff to comply with their design to lure her to their apartment for sexual exploitation.” (R. at 16, p. 2.) Reynolds also alleged that Russell and Carson may have slipped some kind of drug into her drinks. Reynolds, Russell, and Carson left the bar together, and they all got into Russell and Carson’s car. Reynolds realized at some point during the car ride that they were not driving toward her hotel and that Russell and Carson intended to rape her. Reynolds escaped from the car when Russell and Carson stopped to buy cigarettes. She attempted to walk back to her hotel, but because she was still extremely intoxicated, she wandered onto a nearby highway on-ramp and was struck by a car, suffering serious injuries.
As it relates to this appeal, the operative paragraph of her complaint is paragraph 19:
That Defendant Jerzey’s at least knew or should have known that Defendants Russell and Carson were getting Plaintiff Loretta Reynolds intoxicated for the purpose of sexual exploitation. At worst, Defendant Jerzey’s and its employ/agent bartender was an active accomplice in the attempt to ensnare Plaintiff Loretta Reynolds into an unsavory and unwelcome sexual situation.
(Id., p. 5.) She also alleged that CB Sports knew or should have known that she would have tried to escape and that CB Sports “had a duty to protect the welfare of its customers, including Plaintiff Loretta Reynolds from situations such as that being plotted by Defendants Russell and Carson.” (Id.)
CB Sports moved to dismiss her negligence claim against it for failure to state a claim. The district court granted the motion, finding that CB Sports’s duty to protect its business invitees did not extend “to such distances or circumstances as are involved in this case,” and that “there is no reason CB Sports could have reasonably foreseen that there was a danger that one of their patrons would be hit by a vehicle while escaping from criminal activity by another Jerzey’s patron after leaving the bar — or any other harm of that general nature.” Reynolds v. CB Sports Bar, Inc., No. 07-cv-754, 2008 WL 4792704, at *5 (S.D.Ill. Oct.30, 2008).
While Reynolds’s appeal of the district court’s decision was pending in this court, she continued to press her claims against Russell and Carson. Reynolds eventually moved to dismiss Russell from the case. The district court later held an evidentiary hearing in October 2009 in which Reynolds provided a more detailed account of the events in question. Reynolds said that there were two bartenders, one male and one female, and that both refused to give her a phone book, telling her that there were no taxis available. She also said that she asked the bartenders about Russell and Carson. The bartenders allegedly told her that “they were fine. That they [the bartenders] knew them. That they were regulars and that they would be [1146]*1146okay.” (R. at 65, p. 11.) She eventually obtained a default judgment against Carson for $1.5 million. In this appeal we address only the district court’s granting of CB Sports’s motion to dismiss.
II. Analysis
A. Standard of Review
We review the grant of a motion to dismiss for failure to state a claim de novo. Reger Dev. LLC v. Nat’l City Bank, 592 F.3d 759, 763 (7th Cir.), cert. denied, - U.S. -, 130 S.Ct. 3507, — L.Ed.2d -(2010). “[Evaluating the sufficiency of the complaint, we construe it in the light most favorable to the nonmoving party, accept well-pleaded facts as true, and draw all inferences in her favor.” Id. To survive a motion to dismiss, the plaintiff must do more than simply recite elements of a claim; the “complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’” Ashcroft v. Iqbal, — U.S. -, 129 S.Ct. 1937, 1949, 173 L.Ed.2d 868 (2009) (quoting Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 570, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007)). The plaintiff need not, however, plead “detailed factual allegations.” Id.
B. Dramshop Act
At the outset, we note that CB Sports cannot be held liable for Reynolds’s injuries based on it having provided her with alcohol. The Illinois Dramshop Act is the exclusive remedy for injuries resulting from a bar’s provision of alcohol, 235 ILCS 5/6-21; Simmons v. Homatas, 236 Ill.2d 459, 338 Ill.Dec. 883, 925 N.E.2d 1089, 1095 (2010), and the Act does not provide a cause of action for injuries sustained by the intoxicated person himself, 235 ILCS 5/6-21. That being said, Reynolds failed to bring any action under the Dramshop Act within one year of being injured, so any claim she might have had under the Act is time-barred. See id.
The Dramshop Act, however, does not give a bar complete immunity from being sued for tortious conduct; the Act only preempts actions based on the provision of alcohol. A plaintiff may still bring a cause of action against a bar for acts that are independent of serving alcohol. Simmons, 338 Ill.Dec. 883, 925 N.E.2d at 1097-98; Harris v. Gower, Inc., 153 Ill.App.3d 1035, 106 Ill.Dec. 824, 506 N.E.2d 624, 626 (1987). Therefore, although CB Sports’s liability here cannot be premised on its having served Reynolds (or any other patron) alcohol, it may still be liable if Reynolds has adequately stated a claim against CB Sports for some other negligent conduct.
C.Supplemental Facts
The first issue that we must resolve is whether Reynolds may supplement her complaint on appeal with facts that she did not include in her complaint. Of note is her testimony at the evidentiary hearing held after the district court had already dismissed her complaint against CB Sports, in which she testified that the bartenders vouched for Russell and Carson. For the reasons discussed in more detail below, this question is crucial to the outcome of her appeal.
Prior to Iqbal and Twombly, it was clear that “a plaintiff [was] free on appeal to give us an unsubstantiated version of the events, provided it is consistent with the complaint, to show that the complaint should not have been dismissed.” Dawson v. General Motors Corp., 977 F.2d 369, 372 (7th Cir.1992) (internal quotation marks and alteration omitted). The question now is whether Iqbal and Twombly narrowed the pleading standard such that this after-[1147]*1147the-fact hypothesis of facts is no longer permissible.
We conclude that the Supreme Court’s recent decisions, while raising the bar for what must be included in the complaint in the first instance, did not eliminate the plaintiffs opportunity to suggest facts outside the pleading, including on appeal, showing that a complaint should not be dismissed. See Twombly, 550 U.S. at 563, 127 S.Ct. 1955 (“[0]nce a claim has been stated adequately, it may be supported by showing any set of facts consistent with the allegations in the complaint.”); McZeal v. Sprint Nextel Corp., 501 F.3d 1354, 1356 n. 4 (Fed.Cir.2007). Therefore, although the plaintiff is required to plead more than bare legal conclusions to survive a motion to dismiss, once the plaintiff pleads sufficient factual material to state a plausible claim — that is, sufficient to put the defendant on notice of a plausible claim against it — nothing in Iqbal or Twombly precludes the plaintiff from later suggesting to the court a set of facts, consistent with the well-pleaded complaint, that shows that the complaint should not be dismissed.
With this background in mind, we turn to Reynolds’s complaint. In relevant part, Reynolds alleged in her second amended complaint that the bartender refused to help her get a taxicab and told her she would have to get a ride back to her hotel from another patron. She also alleged that the bartender assisted Russell and Carson in getting Reynolds intoxicated knowing their ill intentions. In Count 2 of her second amended complaint, Reynolds alleges that CB Sports “at least knew or should have known that Defendants Russell and Carson were getting Plaintiff Loretta Reynolds intoxicated for the purpose of sexual exploitation,” and “[t]hat Defendant [CB Sports] had a duty to protect the welfare of its customers ... from situations such as that being plotted by Defendants Russell and Carson.” (Complaint at 19, 21.)
Taken together, we find these allegations sufficient to raise a plausible claim of negligence against CB Sports. Although Reynolds could have included more factual material in her complaint, she has done enough to nudge her claim of negligence against CB Sports over the line to plausible, and the complaint on its face is sufficient to put CB Sports on notice of her claim against it. Based on a fair reading of the second amended complaint, CB Sports would have known that Reynolds was suing it for breaching its purported duty to protect her from Russell and Carson. Having made a sufficient showing in the first instance, Reynolds is free on appeal to suggest additional facts that would demonstrate to us why her complaint should not be dismissed for failing to state a claim. We will therefore consider the additional factual allegations that Reynolds has raised on appeal, including the allegation that the bartenders told her that it would be safe for her to ride home with Russell and Carson.
D. Negligence
We first note that the second half of paragraph 19 attempts to state a cause of action for an intentional tort and not for negligence. (See Complaint at 19 (“At worst, Defendant Jerzey’s and its employ/agent bartender was an active accomplice in the attempt ensnare Plaintiff Loretta Reynolds into an unsavory and unwelcome sexual situation.”).) Subject to some inapplicable exceptions, CB Sports is not liable for its agents’ intentional torts, so it cannot be liable for the bartender’s actions if he was an active accomplice of the tortious attack against Reynolds. Accordingly, we now discuss whether the first sentence of paragraph 19 states a claim of negligence.
[1148]*1148
1. Duty
Because federal jurisdiction in this case is based on diversity of citizenship, we apply Illinois substantive law. See Casio, Inc. v. S.M. & R. Co., 755 F.2d 528, 531 (7th Cir.1985). “To state a claim for negligence, a plaintiff must plead a duty owed by a defendant to that plaintiff, a breach of duty, and injury proximately caused by the breach of duty.” Bell v. Hutsell, 402 Ill.App.3d 654, 341 Ill.Dec. 691, 931 N.E.2d 299, 302 (2010). There is normally no duty to protect someone from criminal attacks by third parties. Hills v. Bridgeview Little League Ass’n, 195 Ill.2d 210, 253 Ill.Dec. 632, 745 N.E.2d 1166, 1185-86 (2000). However, a landowner will have a duty to protect lawful entrants against criminal attacks on the premises if the parties stand in a special relationship — such as between a business invitor and invitee, see Rowe v. State Bank of Lombard, 125 Ill.2d 203, 126 Ill.Dec. 519, 531 N.E.2d 1358, 1364 (1988) — and the criminal attack was reasonably foreseeable, Hills, 253 Ill.Dec. 632, 745 N.E.2d at 1186-87; Osborne v. Stages Music Hall, Inc., 312 Ill.App.3d 141, 244 Ill.Dec. 753, 726 N.E.2d 728, 733 (2000) (emphasizing that the criminal act must be not only foreseeable, but reasonably foreseeable); see also Mitchell v. Archibald & Kendall, Inc., 573 F.2d 429, 433 (7th Cir.1978) (“[A]n owner or occupier of land in Illinois owes a duty to invitees on his premises reasonably to guard against criminal acts of third parties when knowledge of previous incidents or circumstances charges him with knowledge of this danger.”). “A criminal attack by a third person is reasonably foreseeable when the circumstances are such as to put a reasonably prudent person on notice of the probability of an attack or when a serious physical altercation has already begun.” Shortall v. Hawkeye’s Bar & Grill, 283 Ill.App.3d 439, 219 Ill.Dec. 90, 670 N.E.2d 768, 770 (1996).
Even if there is a special relationship and the criminal attack is foreseeable, courts must still decide whether to impute a duty to protect against the attack. See Burks v. Madyun, 105 Ill.App.3d 917, 61 Ill.Dec. 696, 435 N.E.2d 185, 189 (1982). Courts will consider a number of factors in deciding whether to impose a duty on someone to protect another, including “(1) the reasonable foreseeability of the injury; (2) the likelihood of the injury; (3) the magnitude of the burden of guarding against the injury; and (4) the consequences of placing that burden on the defendant.” Marshall v. Burger King Corp., 222 Ill.2d 422, 305 Ill.Dec. 897, 856 N.E.2d 1048, 1057 (2006).
Had Reynolds been attacked or harmed while on the bar premises, our task would be substantially easier; business invitor liability for foreseeable criminal attacks on the premises is well established. See, e.g., Lewis v. Razzberries, Inc., 222 Ill.App.3d 843, 165 Ill.Dec. 258, 584 N.E.2d 437, 441 (1991) (citing Restatement (Second) of Torts § 344). Here, however, Reynolds was injured more than one mile from the bar, and guidance from Illinois courts on this issue is decidedly less clear. See Mitchell, 573 F.2d at 433 (noting that where “there are no Illinois cases ‘on all fours’ with the present case, we must decide the case as we believe the Illinois courts would”).
The general rule is that a business invitee ceases to be an invitee, and the business invitor’s liability is therefore extinguished, as soon as the invitee leaves the premises owned by the invitor. See Lewis, 165 Ill.Dec. 258, 584 N.E.2d at 442 (“[T]his court has refused to extend liability to protect against assaults or altercations occurring after a patron leaves the owner’s premises.”); Badillo v. DeVivo, 161 Ill.App.3d 596, 113 Ill.Dec. 696, 515 [1149]*1149N.E.2d 681, 684 (1987) (“This court has repeatedly held that requiring a business operator to protect its patrons from injuries that occur after the patron leaves the premises places an unjustifiable burden on the operator and on the police force.”).
In Badillo, the plaintiff was attacked by another patron of the defendant bar inside the bar. The bar stopped the fight and kicked both patrons out. The original aggressor attacked the plaintiff again as she was getting into her car a half block away from the bar, this time using a police baton. 113 Ill.Dec. 696, 515 N.E.2d at 682. The Illinois Appellate Court held that the bar was not liable for the injuries sustained in the attack that occurred outside the bar, because imposing a duty on the bar to ensure the safety of its patrons off premises, even if an attack is foreseeable, would impose too heavy of a burden on a bar. Id., 113 Ill.Dec. 696, 515 N.E.2d at 683-84; see also Lewis, 165 Ill.Dec. 258, 584 N.E.2d at 441 (finding that a tavern was not liable for a criminal attack on one of its patrons that occurred 23 feet off premises because “[fjrom the time plaintiffs decedent left defendant’s legal boundaries, she was no longer owed a duty of care as a business invitee”).
Applying Illinois law, this court has also found that a business was not liable for a criminal attack by a third party against a truck driver that occurred off the business’s premises, even though the business’s employees directed the truck driver to park on a road near the business on which the employees knew criminal attacks had previously occurred. Mitchell, 573 F.2d at 437.
There are, however, exceptions to the general rule. In Shortall, the Illinois Appellate Court found that a bar could be liable for injuries that occurred during a fight that occurred just outside the bar. 219 Ill.Dec. 90, 670 N.E.2d at 772. The dispute that eventually led to the fight had occurred in the bar, the fight lasted for fifteen minutes, the bar escalated the fight by ushering some patrons outside into the fight, and the bar’s bouncers were watching the fight through a window but did nothing. Id., 219 Ill.Dec. 90, 670 N.E.2d at 769-70. Under those circumstances, the court concluded that the bar “was under the same duty as if the fight had occurred inside the bar.” Id., 219 Ill.Dec. 90, 670 N.E.2d at 772. More generally, the court held that “tavern owners may not avoid application of the duty to act to protect invitees from criminal attack by third parties simply because the disturbance giving rise to the duty occurs just out the front door, especially where the owner contributes to the altercation by sending patrons out into it.” Id.
Similarly, in Osborne, 244 Ill.Dec. 753, 726 N.E.2d at 734, the court found that the defendant nightclub could be liable for a criminal attack against one of its patrons that occurred on the sidewalk in front of the nightclub. Earlier that evening, the nightclub had used barricades to help form the line going into the club. At some point that evening, the nightclub’s bouncers ejected two drunk men and shut the doors behind them. The men pounded on the doors and yelled profanities at the bouncers. The plaintiff and a friend walked out of the club onto the sidewalk in front of the club. One of the men outside slapped the plaintiffs friend, and as the plaintiff approached her friend one of the men spun and kicked her in the face. Id., 244 Ill.Dec. 753, 726 N.E.2d at 729-31. The court said that the reasonable foreseeability of the attack, and not whether the attack occurred on or off premises, was the dispositive factor for liability. Id., 244 Ill.Dec. 753, 726 N.E.2d at 733. Significantly, it found ample evidence to find that the attack against the plaintiff was reasonably [1150]*1150foreseeable: the bouncers knew that the men outside were drunk and angry, that they had already been involved in a fight inside the club, and that they had not cooled off after being evicted. The bouncers did not remove the men from the sidewalk or otherwise police the area even though the club had controlled the sidewalk area earlier that evening. Based on the bouncers’ knowledge and their inaction, the court concluded that “it was reasonably foreseeable that a patron would be attacked upon exiting the club and, therefore, it was incumbent on the club to guard against such an occurrence.” Id., 244 Ill. Dec. 753, 726 N.E.2d at 734.
Most recently, in Haupt v. Sharkey, 358 Ill.App.3d 212, 295 Ill.Dec. 47, 832 N.E.2d 198, 202-03 (2005), the Illinois Appellate Court found that a bar could be liable for a criminal attack against one of its patrons that occurred just off the bar’s premises. After discussing Shortall and Badillo, the court concluded that “there is no bright line rule that a tavern owner’s duty to protect its patrons from criminal acts of third parties absolutely ends at the precise property line of the tavern.” Id., 295 Ill. Dec. 47, 832 N.E.2d at 203. The court held that a bar’s duty “to provide a reasonably safe means of ingress and egress to patrons,” coupled with the foreseeability of the criminal attack that occurred as the patron was evicted from the bar, served to preclude granting summary judgment in the bar’s favor. Id., 295 Ill.Dec. 47, 832 N.E.2d at 204-05.
Against this backdrop, Reynolds asks us to find that CB Sports owed a duty to protect her against Russell and Carson’s criminal attack that was to occur off the physical premises owned by CB Sports. To find in Reynolds’s favor would require us to wade into somewhat uncharted territory because no Illinois court of which we are aware has ever extended business invitor liability so far off premises. However, the fact that Reynolds’s injuries were sustained more than one mile away from CB Sports’s bar does not necessarily preclude finding a duty here. See id., 295 Ill.Dec. 47, 832 N.E.2d at 203-04.
There is no question in this case that Reynolds was a business invitee of CB Sports while she was inside the bar. Therefore, CB Sports clearly had a duty to protect her from foreseeable criminal attacks by third parties while she was inside the bar. The dispositive question, though, is when CB Sports’s duty to protect Reynolds ended the night she was injured. As noted previously, the general rule is that she ceased to be an invitee when she left the physical premises owned by CB Sports. Unless the exception to the general rule discussed above applies, CB Sports cannot be liable for her injuries because it was under no duty to protect her at the time she was injured. Our remaining task, then, is to determine what the scope of the exception to the general rule is and whether Reynolds fits within that exception.
No duty can exist unless the crime was reasonably foreseeable — that is, that a reasonable person under the circumstances would have known that an attack would occur. Id., 295 Ill.Dec. 47, 832 N.E.2d at 204. One clear example of circumstances that should put a bar on notice of a probable criminal attack is when a physical altercation has already occurred. Id. The focus of foreseeability is what the defendant knew at the time. Lewis, 165 Ill.Dec. 258, 584 N.E.2d at 442. Thus, the criminal attack in Shortall was reasonably foreseeable to the bar because the bartender had observed the scuffle that happened inside the bar prior to the fight erupting outside, and a bouncer watched the fight through a window as it escalated. Shortall, 219 Ill.Dec. 90, 670 N.E.2d at 771. In Osborne, [1151]*1151the attack was reasonably foreseeable because the bouncers had previously fought with the attackers while they were in the club, the bouncers heard the men yelling angrily and pounding against the club’s doors, and the bouncers knew that the men were drunk and looking for a fight. Osborne, 244 Ill.Dec. 753, 726 N.E.2d at 734. The court concluded that the club had a duty to protect its patrons against a criminal attack by the men outside the club “[bjecause of what the bouncers knew about the two men.” Id. Finally, the attack in Haupt was foreseeable because the bar owner knew through prior personal experience that the attacker had a propensity for fighting, on the night of the attack he had observed the plaintiff and the attacker fighting in the bar, and he kicked the men out of the bar at the same time. Haupt, 295 Ill.Dec. 47, 832 N.E.2d at 200, 204-05.
Here, Reynolds has alleged, and we are obliged to accept as true, that CB Sports “at least knew or should have known that Defendants Russell and Carson were getting Plaintiff Loretta Reynolds intoxicated for the purpose of sexual exploitation.” She does not say how she knows that the bartender knew, but that is what discovery is designed to unearth. Assuming as true that the bartender knew of Russell and Carson’s criminal purposes, we must conclude that the subsequent unrealized criminal attack on Reynolds was reasonably foreseeable to CB Sports.
Of course, just because a criminal attack is reasonably foreseeable does not necessarily mean that a bar has a duty to protect against it. See Gustafson v. Mathews, 109 Ill.App.3d 884, 65 Ill.Dec. 475, 441 N.E.2d 388, 390 (1982) (“Foreseeability is a necessary but not a sufficient condition for imposing a duty.”). We must also consider the likelihood of injury, the burden on the defendant of guarding against that injury, and any consequences of placing the burden to protect on the bar. Osborne, 244 Ill.Dec. 753, 726 N.E.2d at 732.
The likelihood of injury under these circumstances was very high. This was not a fight that may or may not have broken out in the bar parking lot, but a purposeful scheme to attack Reynolds with serious consequences sure to result. Therefore, this factor weighs in favor of finding a duty.
We do not think it overly burdensome to require a bar to protect against criminal attacks of the kind in this case if it knows they will be perpetrated. CB Sports argues that finding liability here would require all bars to ensure that their patrons do not leave with shady characters and that they all make it safely home. To be sure, we would be inclined to agree with CB Sports that such a broad duty would violate Illinois public policy. But we note two limiting principles, drawn from Illinois courts’ decisions, that make imposing a more limited duty on CB Sports consistent with established Illinois law.
First, CB Sports was under no duty to investigate the plans or intentions of its patrons. To require a bartender to investigate each patron’s purposes in purchasing drinks for themselves or someone else would place an unjustified burden on the bar. This limitation stems logically from the Illinois courts’ holding that a bar is under no duty to determine how intoxicated its patrons are before they drive away from the bar. See Simmons, 338 Ill.Dec. 883, 925 N.E.2d at 1099; Holtz v. Amax Zinc Co., 165 Ill.App.3d 578, 116 Ill.Dec. 464, 519 N.E.2d 54, 58 (1988) (“[W]e do not believe that such an employer can be liable where its agents have simply failed to take steps to prevent an intoxicated employee from driving home.”); Gustafson, 65 Ill.Dec. 475, 441 N.E.2d at 390-91 (describing as “an unjustifiably burdensome responsi[1152]*1152bility” a duty that “would require [businesses] to evaluate the behavior of their customers to determine whether they have the capacity to drive safely”).
The second limiting principle follows naturally from the first. Under the specific facts of this case, CB Sports had a duty to protect against only those criminal attacks occurring far from its physical premises that it knew would occur. Because CB Sports had no duty to investigate the motives of its patrons, it can be liable only for criminal designs of which it was actually aware. After all, the criminal attack must not only be foreseeable, but reasonably foreseeable. And when an attack is to occur far from the physical premises of a bar, it is unreasonable to require a bar to foresee all the hidden, nefarious plans of its patrons. However, it is not overly burdensome to require a bar to protect its invitees if it knows that one patron is intending to attack another patron, even if the attack is to occur far from the bar.
In Simmons, the Illinois Supreme Court found that the rule that taverns are not required to determine the driving capacity of their patrons was no defense to the club in that case. Although it was under no duty to do so, the club had taken on “the burden of determining whether [the defendant drunk driver] was dangerously intoxicated” and had therefore “acquired a duty not to encourage and assist [the defendant] in the tortious conduct of driving while intoxicated.” 338 Ill.Dec. 883, 925 N.E.2d at 1099. Likewise, although CB Sports was not obligated to investigate Russell and Carson’s motives behind buying Reynolds drinks or driving her home, once it allegedly learned of their ill motives it acquired the duty to protect Reynolds from the attack. See also Badillo, 113 Ill.Dec. 696, 515 N.E.2d at 683 (finding no liability for an off-premises criminal attack, and distinguishing Yashar v. Yakovac, 48 N.Y.S.2d 128 (N.Y.City Ct.1944), because in that case, which found a duty, the defendant bar knew that the attackers were waiting for the plaintiff outside the bar).
We conclude that Reynolds has sufficiently pled that CB Sports owed her a duty to protect her against the criminal attack by Russell and Carson if it actually knew of their alleged plan to sexually exploit her off premises. She has also sufficiently pled the remaining elements of her negligence claim. Thus, we need not (and should not) decide at this stage of litigation what CB Sports could have done to discharge its duty, nor whether CB Sports’s inaction (such as failing to warn her or give her a phone book) or action (such as telling her to get a ride home from someone at the bar or vouching for Russell and Carson) breached that duty.
2. Causation
CB Sports asks us to conclude as a matter of law that even if it breached its duty, its breach was not the proximate cause of Reynolds’s injuries. We decline to so find. “[P]roximate cause is preeminently an issue of fact to be decided by the jury,” Rivera v. Garcia, 401 Ill.App.3d 602, 340 Ill.Dec. 224, 927 N.E.2d 1235, 1242 (2010), and the lack of proximate cause should only be determined by the court “where the facts alleged do not sufficiently demonstrate both cause in fact and legal cause,” Young v. Bryco Arms, 213 Ill.2d 433, 290 Ill.Dec. 504, 821 N.E.2d 1078, 1086 (2004).
As with most accidents, there are several factors that may have contributed to Reynolds’s injuries, including the bartender vouching for Russell and Carson and perhaps Reynolds’s own negligence. At this stage of litigation, we cannot say as a matter of law that CB Sports’s actions were not the proximate cause of Reyn[1153]*1153olds’s injuries. And in fact, Reynolds has pled as much. It does not matter that Reynolds’s injuries resulted from being hit by a car while escaping a future attack, rather than from the attack itself. Proximate cause does not require that the defendant foresee the exact way in which an injury will occur. Hooper v. County of Cook, 366 Ill.App.3d 1, 303 Ill.Dec. 476, 851 N.E.2d 663, 669 (2006). If CB Sports knew that Reynolds would be attacked, it was reasonably foreseeable that she would try to escape and perhaps be injured. CB Sports will have another opportunity after discovery to raise the proximate cause issue in a motion for summary judgment— should it be so inclined — at which point Reynolds will have to do more than simply allege proximate cause. Until then, she has done enough to survive a motion to dismiss.
There is one final item with which we may dispense quickly. Reynolds also argues that CB Sports voluntarily assumed the duty to ensure that she make it back to her hotel safely by refusing to give her a telephone book and telling her that no taxis were available. “Generally, pursuant to the voluntary undertaking theory of liability, one who undertakes, gratuitously or for consideration, to render services to another is subject to liability for bodily harm caused to the other by one’s failure to exercise due care in the performance of the undertaking.” Wakulich v. Mraz, 203 Ill.2d 223, 271 Ill.Dec. 649, 785 N.E.2d 843, 854 (2003) (internal quotation marks omitted). In general, taverns are not required to ensure their patrons’ safe passage to their cars or homes. Badillo, 113 Ill.Dec. 696, 515 N.E.2d at 684. To voluntarily assume such a duty requires more than just not helping patrons safely to their cars. See Lewis, 165 Ill.Dec. 258, 584 N.E.2d at 441-42. We do not think that simply not giving Reynolds a phone book or telling her to get a ride home with someone else in the bar is enough to say that CB Sports voluntarily assumed a duty to ensure her safe arrival at her hotel. Reynolds therefore has failed to state a claim under a voluntary undertaking theory of liability.
III. Conclusion
We Reverse the district court’s judgment of dismissal of CB Sports Bar, Inc., and Remand for further proceedings consistent with this opinion.