
716 N.E.2d 323 (1999)
306 Ill. App.3d 1131
240 Ill.Dec. 190
John DOE, Plaintiff-Appellant,
v.
Robert GOFF, Boy Scouts of America, and Rainbow Council, Boy Scouts of America, Defendants-Appellees.
No. 3-98-0826.
Appellate Court of Illinois, Third District.
August 19, 1999.
Rehearing Denied September 17, 1999.
*324 Paul Perona (argued), Perona Law Offices, Peru, for John Doe.
Dana C. Crowley (argued), Dana Crowley & Associates, Chicago; Robert Marc Chemers, Scott L. Howie (argued), Pretzel & Stouffer, Chtd., Chicago, for Boy Scouts of America and Rainbow Council.
Justice HOMER delivered the opinion of the court:
The plaintiff filed a complaint against Robert Goff, the Boy Scouts of America (Boy Scouts), and the Rainbow Council Boy Scouts of America (Rainbow Council), after he was allegedly molested by Goff while at a Boy Scouts' camp. The trial court granted summary judgment in favor of the Boy Scouts and the Rainbow Council, *325 and the plaintiff appealed. Following our careful review, we affirm.

FACTS
In 1987 and 1988, the plaintiff was a member of the Rainbow Council of the Boy Scouts in Joliet, Illinois. In January 1995, the plaintiff filed a complaint against the Rainbow Council, the Boy Scouts, and Robert Goff, a Boy Scout volunteer, for damages that he incurred as a result of an alleged molestation by Goff at a Boy Scouts camping trip in the summer of either 1987 or 1988. He contended that the Boy Scouts and Rainbow Council (the appellees) negligently failed to investigate the moral fitness of Goff, and allowed Goff to participate in scouting activities knowing that he was a pedophile who sexually abused some of the scouts. The plaintiff also alleged that the appellees failed to implement adequate child protection programs.
The appellees filed a motion for summary judgment alleging that they did not owe the plaintiff a duty because they did not voluntarily undertake to investigate any adult volunteers, and were unaware that Goff molested any boys until 1992. The trial court granted the appellees' motion for summary judgment. However, the court also granted the plaintiff leave to file an amended complaint so that he could add allegations regarding the appellees' failure to properly educate the plaintiff about abuse.
The plaintiff's amended complaint alleged that the appellees failed to implement adequate child protection and education programs, and failed to adequately warn the plaintiff about sexual abuse.
The appellees filed a motion for summary judgment on the amended complaint, alleging that they had no duty to implement additional child protection programs or otherwise educate or warn the plaintiff about abuse. The plaintiff argued that the appellees did owe him a duty because they (1) had a special relationship with the scouts so as to create the existence of a duty; and (2) voluntarily undertook to implement child protection programs.
The trial court granted the appellees' motion for summary judgment, again finding that the appellees did not owe a duty to the plaintiff. The plaintiff appeals this second order granting summary judgment in favor of the appellees.

ANALYSIS
A motion for summary judgment is a drastic remedy that should be granted only when the pleadings, depositions, and admissions on file, together with the affidavits, show that there is no genuine issue of material fact and that the movant is entitled to judgment as a matter of law. Gilbert v. Sycamore Municipal Hospital, 156 Ill.2d 511, 517-518, 190 Ill.Dec. 758, 622 N.E.2d 788, 792 (1993). The standard of review of a trial court's decision on a motion for summary judgment is de novo. Andrews v. Cramer, 256 Ill.App.3d 766, 769, 195 Ill.Dec. 825, 629 N.E.2d 133, 135 (1993).
The plaintiff argues that the trial court erred in granting summary judgment to the appellees, because he set forth facts sufficient to establish a prima facie case of negligence. In order to prevail in a negligence action, a plaintiff's complaint must set forth facts establishing the existence of a duty owed by defendant to plaintiff, a breach of that duty and an injury proximately caused by the breach. Auguste v. Montgomery Ward and Co., 257 Ill.App.3d 865, 868, 195 Ill.Dec. 950, 629 N.E.2d 535, 537 (1993). The determination of a duty, or whether the plaintiff and defendant stood in such a relationship to one another that the law imposes an obligation of reasonable conduct upon the defendant for the benefit of the plaintiff, is a question of law. Estate of Johnson v. Condell Memorial Hospital, 119 Ill.2d 496, 503, 117 Ill.Dec. 47, 520 N.E.2d 37, 40 (1988).
*326 Generally, Illinois law does not impose a duty to protect another from a criminal attack by a third person. Hernandez v. Rapid Bus Co., 267 Ill.App.3d 519, 524, 204 Ill.Dec. 456, 641 N.E.2d 886, 890 (1994). However, a duty to protect another can exist if the attack was reasonably foreseeable and the parties stand in one of the following "special relationships": (1) common carrier and passenger; (2) innkeeper and guest; (3) business invitor and invitee; and (4) voluntary custodian and protectee. Hernandez, 267 Ill.App.3d at 524, 204 Ill.Dec. 456, 641 N.E.2d at 890.
The plaintiff contends that the appellees owed him a duty to prevent the molestation because they stood in a special relationship with him as his voluntary custodians. We find this argument unpersuasive because it ignores the additional requirement that the wrong be foreseeable.
As the plaintiff's voluntary custodian, the appellees had a duty to protect him from foreseeable harm. However, the plaintiff has not shown that his molestation was reasonably foreseeable in this instance. Therefore, the appellees cannot be found liable under this exception. See Estate of Johnson, 119 Ill.2d at 503, 117 Ill.Dec. 47, 520 N.E.2d at 40 (holding that a duty is imposed where there is a special relationship and the attack was reasonably foreseeable).
A criminal attack by a third person is reasonably foreseeable when the circumstances are such as to put a reasonably prudent person on notice of the probability of an attack. Shortall v. Hawkeye's Bar and Grill, 283 Ill.App.3d 439, 443, 219 Ill.Dec. 90, 670 N.E.2d 768, 770 (1996). Generalized allegations of crime will not suffice to establish that future criminal attacks are foreseeable. Popp v. Cash Station, Inc., 244 Ill.App.3d 87, 93, 184 Ill.Dec. 558, 613 N.E.2d 1150, 1153 (1992). Foreseeability is something that is objectively reasonable to expect, not merely what might conceivably occur. Benner v. Bell, 236 Ill.App.3d 761, 766, 177 Ill.Dec. 1, 602 N.E.2d 896, 899 (1992). It must be judged by what was apparent to the defendant at the time of the attack, and not by what may appear through hind-sight. Lewis v. Razzberries, Inc., 222 Ill.App.3d 843, 851, 165 Ill.Dec. 258, 584 N.E.2d 437, 442 (1991).
At the time of the alleged attack by Goff, neither the Boy Scouts nor the Rainbow Council could be found to have reasonably foreseen that the plaintiff would be molested. They had no reason to believe that Goff, or anyone at the camp, was predisposed to commit sexual abuse. Goff was a pediatrician who had no criminal record and no known propensity to be a child molester. Further, there was no evidence to suggest that anyone at the camp committed abuse in the past, had any type of criminal record, or was predisposed to commit abuse.
Nevertheless, the plaintiff argues that public policy mandates that a duty be imposed on the Boy Scouts and its local councils to protect scouts from sexual assault. He points out that other boy scouts have been sexually abused in the past by adult volunteers.
According to the plaintiff's motion for summary judgment, 104 adult volunteers were placed in an ineligible volunteer file in 1988 because of reported incidents of sexual abuse. Ninety-five volunteers were placed in that file in 1987. However, according to an article that was attached to the plaintiff's motion for summary judgment, more than one million adults serve as scout volunteers each year. Therefore, dividing the number of ineligible volunteers by the total number of volunteers, it appears as if less than .011% of adult volunteers were suspected of committing abuse in 1988, and less than .0096% of adult volunteers were suspected of committing abuse in 1987.
Based upon the plaintiff's statistics, we conclude that the overwhelming majority of Boy Scout volunteers serve in that capacity in order to teach young boys the virtues of patriotism, courage and self-reliance, *327 and are not sexual predators. Because the alleged act of molestation by Goff was not foreseeable, the plaintiff has not established the "special relationship" exception to the general rule of non-liability for the criminal acts of another.
The plaintiff next contends that the appellees are subject to liability under the "voluntary undertaking" exception, which is a second exception to the general rule that one does not owe a duty to protect another from a criminal attack. Section 324A of the Restatement (Second) of Torts (Restatement (Second) of Torts § 324A (1965)), states:
"One who undertakes, gratuitously or for consideration, to render services to another which he should recognize as necessary for the protection of a third person or his things, is subject to liability to the third person for physical harm resulting from his failure to exercise reasonable care to protect his undertaking if
(a) his failure to exercise reasonable care increases the risk of such harm, or
(b) he has undertaken to perform a duty owed by the other to the third person, or
(c) the harm is suffered because of reliance of the other or the third person upon the undertaking."
In the instant action, the plaintiff argues that the appellees undertook to implement programs to educate the scouts and parents about abuse, and to protect the scouts from abuse. They published brochures and videos on abuse, and created rules aimed at preventing abuse. The plaintiff contends that these actions amounted to voluntary undertakings, and thereby created the existence of a duty. Therefore, the plaintiff argues that summary judgment was inappropriate.
We do not believe that the appellees' actions amounted to a voluntary undertaking which could render them liable for the plaintiff's molestation. There is no evidence in the record that the appellees in the instant action undertook to implement a detailed program to eliminate abuse. Instead, they made available videos and publications in which they warned about the danger of abuse, and explained various methods to recognize and prevent abuse. Those general measures are insufficient to create the existence of a duty as alleged in the plaintiff's complaint under the voluntary undertaking exception. See Frye v. Medicare-Glaser Corp., 153 Ill.2d 26, 178 Ill.Dec. 763, 605 N.E.2d 557 (1992) (holding that the defendant pharmacy had no duty to warn of a drug's potential dangerousness when combined with alcohol even though it did warn of the drug's propensity to cause drowsiness).
The plaintiff points to Decker v. Domino's Pizza, Inc., 268 Ill.App.3d 521, 205 Ill.Dec. 959, 644 N.E.2d 515 (1994) and Martin v. McDonald's Corp., 213 Ill. App.3d 487, 157 Ill.Dec. 609, 572 N.E.2d 1073 (1991), as support for his argument that the appellees' actions amounted to a voluntary undertaking. However, neither of these cases is analogous to the instant case.
The plaintiffs' claims in Martin arose out of a robbery of employees that occurred at a McDonald's restaurant after closing hours. The plaintiffs claimed that McDonald's Corporation owed them a duty of care because it voluntarily assumed such a duty. In finding that McDonald's had assumed such a duty, the court relied on the fact that McDonald's created a branch of its corporation to deal with security measures, prepared a manual for security operations, checked for specific security problems through a regional security manager, and followed-up to ensure that security recommendations were being followed. Martin, 213 Ill.App.3d at 491-492, 157 Ill.Dec. 609, 572 N.E.2d at 1077.
Similarly, the court in Decker found that Domino's Pizza voluntarily assumed a duty to protect its employee against an attempted robber where Domino's established a department to handle security-related matters, *328 generated material on safety, developed a hotline for security-related matters, and established follow-up procedures. Decker, 268 Ill.App.3d 521, 205 Ill.Dec. 959, 644 N.E.2d 515.
In the instant action, the appellees did not implement the detailed security procedures that were established in Martin and Decker. They did not create a separate branch of their organization to deal with security; they did not establish detailed security rules and follow-up procedures; and they did not develop a hotline to handle security matters. Thus, the extent of the undertaking in the instant action falls far short of that in Decker and Martin, and the voluntary undertaking exception fails.
Therefore, we find that the trial court correctly granted summary judgment in favor of the appellees.

CONCLUSION
For the foregoing reasons, the judgment of the circuit court of La Salle County is affirmed.
Judgment affirmed.
SLATER, J., concurs.
Justice BRESLIN, dissenting:
From the record we know that on an average of more than once a week for the past two decades, a Cub Scout, Boy Scout or Explorer Scout of the Boy Scouts of America (Boy Scouts) has reported being sexually abused by an adult leader. P. Boyle, Scout's Honor, Washington Times, May 20, 1991, at 7.
The parties stipulated in this case that, between 1981 and 1988, 392 adult volunteer leaders were placed on ineligible lists because of alleged sexual abuse of scouts. In 1988 alone, the Boy Scouts headquarters was notified of over one hundred allegations of molestation of troop members by adult leaders.
Furthermore, the record indicates that the Boy Scouts has taken steps to address sexual abuse of its scouts by: (1) publishing a pamphlet entitled Child Abuse: Let's talk about it and a booklet called How to protect your children from child abuse and drug abuse; and (2) producing and distributing a 90 minute videotape addressing sexual abuse and an educational video for scouts seeking help from being abused.
Yet the majority holds that if in fact Scout Doe was molested this act was not reasonably foreseeable so as to impose a duty on the Boy Scouts to protect him from an alleged criminal attack by his scout leader.
I cannot agree.
The majority's first failing is to essentially reduce foreseeability to a question of mere mathematical probability. They say that less than 0.011% of volunteers were suspected of committing sexual abuse against a scout in any given year. I take issue with this conclusion for two reasons. First, this statistic was not provided by either party, nor made part of the record on appeal. Second, and much more importantly, whether a risk is foreseeable is not a question of simple mathematical probability. W. Prosser, Torts § 31, at 171 (5th ed.1984); see Gallagher v. Montpelier & Wells River R.R., 100 Vt. 299, 137 A. 207 (1927)(although the odds may be a thousand to one that a train will enter a crossway at the precise moment a car is passing over the same track, the risk of death is serious enough to require precaution); see also Helling v. Carey, 83 Wash.2d 514, 519 P.2d 981 (1974)(doctors negligent for failing to administer eye test even though risk of glaucoma in those under forty was only 1 in 25,000). While the statistical chance a scout will be sexually abused may be small, I believe that the physical and psychological damage caused by sexual molestation of minors is so great that a duty should be placed upon the Boy Scouts to take steps to protect the young boys in their care.
Having found the harm foreseeable, I would impose a duty upon the Boy Scouts *329 because they stand in a special relationship with the scouts. According to the Restatement of Torts, a special relationship is created when one voluntarily takes custody of another so as to deprive the other of his normal opportunities of protection. Restatement (Second) of Torts, § 314A (1965).
Think about it. Each year thousands of young boys wave goodbye to mom and dad and go off to attend remote boy scout outings across the continent. Some of these expeditions last a week or more. There they areout in the wildernessno phone, no parents, no police, no teachers, none of the usual safety nets. Just the birds and the bears and the Boy Scout leaders. If that is not a description of taking custody so as to deprive one of normal opportunities of protection, I do not know what is.
The Boy Scouts and its volunteers are responsible for the care and well-being of these vulnerable and impressionable children. In effect, they voluntarily step into the shoes of the parents. With such an undertaking should come the duty to act within reasonable means to protect scouts from sexual abuse by their adult leaders. Other courts have imposed such a duty. See L.P. v. Oubre, 547 So.2d 1320 (1989)(court held Boy Scouts of America and local council owed individual scouts a duty of care to protect them from sexual abuse); Wallace v. Boys Club of Albany, Georgia, Inc., 211 Ga.App. 534, 439 S.E.2d 746 (1993)(person who undertakes the control and supervision of a child has the duty to use reasonable care to protect the child from molestation). Why not Illinois?
I do not wish to be understood as saying that the Boy Scouts will be found negligent in every case of sexual abuse of a scout. Although I would hold that the Boy Scouts owed Doe a duty of care, Doe would still have to show that the Boy Scouts breached that duty in order to recover. I simply believe that it is both absurd and dangerous for the majority to hold that no duty exists. While I am empathetic toward volunteer groups, my research reveals no case in which the duty analysis for eleemosynary organizations is any different than for civil organizations. Accordingly, I would reverse the entry of summary judgment and allow the case to proceed to trial.
