
2 N.Y.3d 288 (2004)
810 N.E.2d 894
778 N.Y.S.2d 442
RAM KRISHNA MAHESHWARI et al., Appellants,
v.
CITY OF NEW YORK et al., Respondents, et al., Defendants.
Court of Appeals of the State of New York.
Argued March 25, 2004.
Decided May 6, 2004.
*289 Nitkewicz & McMahon, LLP, Commack (Edward J. Nitkewicz and Jinan M. Arafat of counsel), for appellants.
*290 Michael A. Cardozo, Corporation Counsel, New York City (Julian L. Kalkstein and Larry A. Sonnenshein of counsel), for City of New York, respondent.
*291 Law Office of Ted M. Tobias, New York City (Milagros A. Matos of counsel), for Delsener/Slater Enterprises, Ltd., respondent.
Chief Judge Kaye and Judges G.B. Smith, Ciparick, Graffeo, Read and R.S. Smith concur.

OPINION OF THE COURT
ROSENBLATT, J.
Randomly and without provocation, four unidentified hoodlums attacked plaintiff in the parking lot at a music festival in a New York City park. We must decide whether plaintiff may hold the City and the concert producer liable.
On July 10 and 11, 1996, defendant Delsener/Slater produced a Lollapalooza concert at Downing Stadium, a facility owned by defendant City of New York, on Randall's Island. The festival included heavy metal and rap acts such as Metallica, Soundgarden, Wu Tang Clan and the Ramones. Delsener entered into a *292 stadium use agreement with the City, by which Delsener was to provide "supervision of the parking areas for the Event," including "sufficient trained security personnel as may be necessary" to police the stadium and additional facilities, ensure the orderly entrance and exit of patrons, manage the parking and traffic flow, and safeguard the property.
In addition, the contract called on Delsener to "prepare and submit a site and operations plan" detailing "public vehicular and pedestrian traffic circulation, parking control, and security from the Triborough Bridge ramps and the access roads to the designated ballfields to be used for parking and access to the stadium area." The agreement also obligated Delsener to furnish a plan for the "number, location and hours of deployment of licensed security personnel assigned to the . . . parking fields."
Several weeks before the event, representatives of those involved in the planning (including Delsener, the Police Department, the Parks Department and other private security companies) attended an "all-agency meeting" to discuss logistics. The participants agreed that the City, through the Police Department and the Parks Department Parks Enforcement Police (PEP), would provide security in the parking areas. On the days of the concert, the security plan was in place: 24 police officers, three sergeants and approximately two dozen PEP officers patrolled the parking areas. Police were assigned to maintain the island during the concert and to move the crowd of 25,000 people safely in and out of the stadium. PEP's role was to patrol the parking areas in search of illegal vendors, alcohol, open fires and littering. Delsener also contracted with another firm to maintain the traffic flow and direct parking in the parking areas.
On July 10, 1996, plaintiff went to the concert to distribute pamphlets on behalf of the International Society for Krishna Consciousness. While in the Sunken Meadow parking area, four unidentified young men assaulted him without provocation. When the attack occurred, officers were stationed at certain parts of the parking fields, but apparently none were in the Sunken Meadow parking area. Plaintiff suffered serious personal injury at the hands of his attackers, whom he described as "heavily drunk, red eyes, bottles in their hand, smelling." As the Appellate Division noted, "[a]lthough plaintiff did not see any police officers or anybody on horseback in the parking lot, he saw people in uniform directing traffic" (307 AD2d 797, 798-799 *293 [1st Dept 2003]). At a deposition, a police officer testified that, according to his "post list," no police officer had been assigned to the Sunken Meadow parking area.
In his complaint, plaintiff (and his wife derivatively) sued Delsener and the City for not providing adequate security.[1] Delsener moved for summary judgment, claiming in essence that it owed plaintiff no duty to prevent a random criminal act of this kind. Supreme Court denied the motion and Delsener appealed. By a divided court, the Appellate Division reversed and granted summary judgment not only to Delsener but to the City as well.[2] The Court based its decision on Florman v City of New York (293 AD2d 120 [1st Dept 2002]), in which another plaintiff was injured in the parking area at the same Lollapalooza concert. In assuming that the injury in Florman was the result of a willful attack, the Court concluded that plaintiff had failed to raise a triable issue of fact as to foreseeability and proximate cause.
Two Justices dissented, believing there to be questions of fact as to the predictability of criminal assaults at a Lollapalooza concert. They referred to a journalist's description of the event as attended by "a moshing crowd of bare-chested, sweating, staggeringly drunk and stoned `Beavis and Butt-Head' types." (307 AD2d at 801.) We now affirm the order of the Appellate Division.
In arguing that the City and Delsener breached their duty to provide adequate security in the parking area, plaintiff seeks to hold Delsener liable under the stadium use agreement and the City in its proprietary capacity as the owner of Downing Stadium and Randall's Island. Plaintiff maintains that the crime was foreseeable because defendants had notice of criminal activity at previous Lollapalooza festivals, and that defendants' negligence in providing security was a proximate cause of his injury.
Plaintiff essentially argues that Lollapalooza attracts concertgoers who are predictably prone to criminal behavior. In support, he presented statistics from previous Lollapalooza concerts *294 in which arrests were made for disorderly conduct, misdemeanor assault, criminal mischief, resisting arrest and possession of stolen property. He also claims that defendant knew that one of the musical acts, Wu Tang Clan, had violent incidents at previous concerts. Further, plaintiff argues that defendants knew that tailgating occurred in the parking areas before and during the concert. Tailgating, he contends, increases the chances that criminal activity will occur, presumably because tailgaters may drink alcoholic beverages.
Defendants argue that any duty they owed to plaintiff did not include a guarantee of protection from a random act of violence. They assert that the indiscriminate, spontaneous assault upon plaintiff was not proximately caused by any deficiency in security. We conclude that the Appellate Division was correct in accepting defendants' arguments.
We have long held that "New York landowners owe people on their property a duty of reasonable care under the circumstances to maintain their property in a safe condition" (Tagle v Jakob, 97 NY2d 165, 168 [2001]; see Basso v Miller, 40 NY2d 233, 241 [1976]). Although landlords and permittees have a common-law duty to minimize foreseeable dangers on their property, including the criminal acts of third parties, they are not the insurers of a visitor's safety (see Burgos v Aqueduct Realty Corp., 92 NY2d 544, 548 [1998]; Jacqueline S. v City of New York, 81 NY2d 288, 292-293 [1993], rearg denied 82 NY2d 749 [1993]; Nallan v Helmsley-Spear, Inc., 50 NY2d 507, 519 [1980]). As we have noted, however, foreseeability and duty are not identical concepts. Foreseeability merely determines the scope of the duty once the duty is determined to exist (see Pulka v Edelman, 40 NY2d 781, 785 [1976]). In cases arising out of injuries sustained on another's property, the scope of the possessor's duty is defined by past experience and the "likelihood of conduct on the part of third persons . . . which is likely to endanger the safety of the visitor" (Nallan, 50 NY2d at 519, quoting Restatement [Second] of Torts § 344, Comment f).
Here, the brutal attack was not a foreseeable result of any security breach. The types of crimes committed at past Lollapalooza concerts are of a lesser degree than a criminal assault, and would not lead defendants to predict that such an attack would occur or could be prevented. By all accounts, defendants took reasonable measures to deal with issues of crowd control and other forms of disorderliness short of unprovoked criminal acts. A random criminal attack of this nature is not a predictable result of the gathering of a large group of people.
*295 The Appellate Division concluded, as do we, that the record reveals no failure by the organizers of the event to provide adequate control or security. The concert was host to thousands of people over a large area. Security officers cannot be everywhere at once. As the Appellate Division stated in Florman, "[i]t is difficult to understand what measures could have been undertaken to prevent plaintiff's injury except presumably to have had a security officer posted at the precise location where the incident took place or wherever pedestrians were gathered, surely an unreasonable burden" (293 AD2d at 127).
Plaintiff and the Appellate Division dissenters rely heavily on Rotz v City of New York (143 AD2d 301 [1st Dept 1988]). There, the Appellate Division denied summary judgment to defendants after the plaintiff sustained injury at a concert in Central Park when a stampeding crowd trampled over him. While we do not express an opinion on the merits of that case, it is enough to say that it is, in any event, distinguishable from the one before us. The Appellate Division correctly recognized that Rotz involved crowd control, which is not the issue here.
We also agree with the Appellate Division's conclusions that even assuming a lapse in the security in the parking lot, plaintiff's injuries were not the result of any such lapse, but were caused by an independent, intervening criminal act. To establish a prima facie case of proximate cause, a plaintiff must show "that the defendant's negligence was a substantial cause of the events which produced the injury" (Derdiarian v Felix Contr. Corp., 51 NY2d 308, 315 [1980]). "Where the acts of a third person intervene between the defendant's conduct and the plaintiff's injury, the causal connection is not automatically severed. In such a case, liability turns upon whether the intervening act is a normal or foreseeable consequence of the situation created by the defendant's negligence" (id.). An intervening act may break the causal nexus when it is "extraordinary under the circumstances, not foreseeable in the normal course of events, or independent of or far removed from the defendant's conduct" (id.). Here, as an independent act far removed from defendants' conduct, the criminal assault broke the causal nexus. The attack was extraordinary and not foreseeable or preventable in the normal course of events.
Inasmuch as we agree with the Appellate Division's dismissal of the action against the City on the lack of foreseeability and on the absence of causation, we need not address the City's argument that it is immune from liability based on its claim *296 that it acted in a governmental, and not proprietary, capacity. In addition, plaintiff's remaining arguments are without merit.
Accordingly, the Appellate Division order should be affirmed, with costs.
Order affirmed, with costs.
NOTES
[1]  The remaining defendants  Randall's Island Sports Foundation, Inc., Keith Kevan Organization, Inc. and Keith Kevan  are not parties to this appeal. Supreme Court dismissed all claims against the Kevan defendants.
[2]  Although the City did not appeal from Supreme Court's order, the Appellate Division had the authority to search the record and grant summary judgment to the City under CPLR 3212 (b) (see Merritt Hill Vineyards v Windy Hgts. Vineyard, 61 NY2d 106 [1984]).
