During the early morning hours of October 2, 1989, a fire started by an arsonist broke out in the Red Inn (the inn) in Provincetown. The plaintiffs, husband and wife, were paying guests of the inn that night. To escape the *434fire, they jumped out of a second-story window and were injured. They brought suit against (1) Duane A. Steele as trustee of the Tamerlane Realty Trust (the trust), the owner of the building, (2) Tamerlane Corp. (the corporation), a Massachusetts corporation which leased the building from the trust and owned and operated the inn4; and (3) Duane A. Steele and Mary Jo Avellar, individually5; for negligently failing to provide a proper and safe means of egress.
A jury-waived trial was held at the Brookline District Court. At the close of the plaintiffs’ case, the defendants moved for an involuntary dismissal, see Mass.R.Civ.P. 41(b) (2), 365 Mass. 804 (1974). The judge denied the motion, as well as various requests for rulings. The defendants offered no evidence. On February 12, 1993, the judge found for the plaintiffs against all defendants, awarding Addis $98,800 and Reed $22,000. The defendants appealed to the Appellate Division of the District Court, alleging error in the denial of their rule 41(b) motion and in the denial of certain requests for rulings. The Appellate Division dismissed the report and affirmed the judgment on January 18, 1994. The defendants now appeal to this court,6 claiming (1) the intervening crimi*435nal act of a third party relieves the defendants of tort liability; and (2) there is no basis for liability against the trust or the individual defendants. We affirm the judgment against the corporation, but we reverse as to the trust and the individual defendants.
The judge found the following facts.7 We add undisputed facts, as appropriate. At approximately 12:30 a.m. on October 2, 1989, Steele stopped by the inn “to check on things.” He found the windows closed and the doors locked, so he left. Soon thereafter, the plaintiffs were awakened by the fire alarm. They ran down the stairs they had ascended earlier. The premises were in darkness and full of smoke; the dining room was afire. First, they tried to leave by the door through which they had entered that part of the building: it was locked. Other efforts to escape from the first floor were unsuccessful. Ultimately, they returned to the second floor, forced open a window, jumped out, and were injured.
The court also found that the plaintiffs were left to sleep in the inn alone. There was no one on duty “or even sleeping on the premises ... If the inn was being watched, guarded or supervised ... no arsonist could have accomplished his or her heinous crime.”
The judge concluded that there was negligence consisting of the failure to have someone on duty at the inn during the nighttime, the failure to provide sufficient or emergency lighting, and the failure to provide access to exits, properly marked and easily opened. The judge also concluded that the defendants “could have foreseen that a third party wrongdoer could commit an intervening criminal act,” and that the defendants could reasonably have anticipated the fire.
The defendants argue that the trial judge should have allowed their motion for involuntary dismissal, first, because *436they are not responsible for the plaintiffs’ injuries caused by an arsonist (i.e., that the intervening criminal act of a third party relieves them of liability) and second, because there was no evidence that any defendant was negligent concerning any condition of the premises which caused harm to the plaintiffs.8 The test is whether the plaintiffs’ evidence, and all reasonable inferences therefrom drawn in their favor, is sufficient to support a judgment for the plaintiffs. See Kendall v. Selvaggio, 413 Mass. 619, 625 (1992); Smith & Zobel, Rules Practice § 41.10, at 59 (1977).
1. Discussion. There was ample justification in the record to support the judge’s findings of fact. We place those facts against the background of the applicable law.
While innkeepers are not insurers of their guests’ safety, McFadden v. Bancroft Hotel Corp., 313 Mass. 56, 59-60 (1943), they do owe a duty to take steps to protect their guests against unreasonable risk of physical harm. Bearse v. Fowler, 347 Mass. 179, 181 (1964). Fund v. Hotel Lenox of Boston, Inc., 418 Mass. 191, 192-193 (1994). Restatement (Second) of Torts § 314A(1) (a), (2), & illus. 3 (1965). The duty is grounded on the “special relationship” that exists between a hotel and its guests. Whittaker v. Saraceno, 418 Mass. 196, 197 (1994). See also Mullins v. Pine Manor College, 389 Mass. 47, 53 n.9 (1983), and cases cited. As in Mullins, “it can be said with confidence that . . . [innkeepers] of ordinary prudence customarily exercise care to protect the well-being of their . . . [paying guests].” Id. at 51. It is commonly recognized that innkeepers provide protection against the peril of fire, and paying guests expect that to be so. No one would doubt that waking up in the nighttime, in a strange building, to the sound and sight of a fire, is an event much to be feared. Sprinkler systems, plainly marked exit signs, emergency lighting systems, and clear and obvious instructions about what to do in case of fire are the rule, not the exception.
*437Thus, the State Building Code, 780 Code Mass. Regs. § 604.1 (1980), as in effect in 1989, provided that “[t]he owner or lessee of every existing building and structure shall be responsible for the safety of all persons in, or occupying, such premises with respect to the adequacy of means of egress therefrom.” Title 780 Code Mass. Regs. § 607.2 (1980) provided that “[a]ll required exitways shall be so located as to be discernible and accessible with unobstructed access thereto.” 780 Code Mass. Regs. § 624 (1981) contained detailed provisions regarding “Means of Egress Lighting,” and 780 Code Mass. Regs. § 1202 (1981) described the installation and maintenance of “Fire Suppression Systems.”
We have no doubt that the corporation owed the plaintiffs a duty of due care, and that by failing to provide adequate lighting and a clear and obvious exit path from the building in the event of fire, the corporation failed to perform its duty of protecting the plaintiffs against an unreasonable risk of injury. But whether that failure is sufficient to fasten liability on the corporation turns on whether the corporation is correct in arguing that because the fire was set Jiy_an arsonist, the corporation did not have the duty to protect the plaintiffs from the criminal activity of a third person.
The question boils down to the issue of foreseeability. “The word ‘foreseeable’ has been used to define both the limits of a duty of care and the limits of proximate cause.” Whittaker v. Saraceno, 418 Mass. at 198. The judge found as a fact that the arson was foreseeable, see Mullins v. Pine Manor College, 389 Mass. at 58; Roberts v. Southwick, 415 Mass. 465, 473-474 (1993), but the corporation argues that we should rule, as matter of law, that in the circumstances of this case, the harm caused by a fire set by an arsonist was not a reasonably foreseeable risk. We see no sound reason to do so.
The corporation concedes that “the possibility of fire was foreseen and guarded against with . . . smoke detector, sprinkler and alarm system [s].” Given the foreseeability of a fire at the inn, the corporation gains no benefit from the fact that the fire was set. “The duty to protect the other against unreasonable risk of harm extends to . . . risks arising from
*438. . . acts of third persons, whether they be innocent, negligent, intentional, or even criminal.” Restatement (Second) of Torts § 314A comment d. The judge was warranted in finding that the corporation’s failure to provide adequate lighting and egress created a foreseeable risk that a fire, however started9 — innocently, negligently, or by a criminal act — would cause harm to its guests, and the Appellate Division was correct in dismissing the report as to the corporation. See Fund v. Hotel Lenox of Boston, Inc., 418 Mass. at 194 (the failure of the hotel to maintain an adequate security system created the foreseeable risk that a trespasser would gain entrance to the hotel and assault a guest). See also Mozer v. Semenza, 177 So. 2d 880, 882-883 (Fla. Dist. Ct. App. 1965) (finding for the plaintiff in an action for injuries from a fire started by an arsonist affirmed; the act of the arsonist was not an “independent intervening cause”).
2. The liability of the trust and the individuals. The judge ruled that the trust as well as the individuals was liable to the plaintiffs, and the Appellate Division affirmed that judgment. We disagree.
a. As to the trust. After the expiration of the written lease from the trust to the corporation, the corporation held over by agreement and became a tenant at will, Chester A. Baker, Inc. v. Shea Dry Cleaners, Inc., 322 Mass. 311, 312 (1948), upon the terms of the expired, written lease, Boudreau v. Johnson, 241 Mass. 12, 16 (1922), and the corporation remained in exclusive possession and control of the premises. Under the terms of the expired lease, the corporation had the duty to maintain the leased , premises in good condition; the trust was obliged merely to maintain the structure of the building. As to injuries occurring within the areas rented to the corporation, but over which the trust had no control,10 the trust would be liable only if it contracted to make repairs *439and made them negligently, causing injury. Chausse v. Coz, 405 Mass. 264, 266 (1989). No such facts were found by the judge in this case, and the trust cannot be held liable to the plaintiffs.
b. As to the individuals. The judge found that there was “no evidence that anyone was on duty or even sleeping on the premises .... If the inn was being watched, guarded or supervised, I find that no arsonist could have accomplished his or her heinous crime. This ... I find, clearly, as negligence on the part of all the defendants or their agents.”
Aside from the absence of subsidiary findings necessary to support this conclusion (leaving the conclusion entirely speculative), there is the further and more important difficulty that there was no finding by the judge, nor any evidence upon which to base a finding, that the individual defendants participated in the wrongdoing identified by the judge: that no one was watching, guarding, or supervising the inn when the fire broke out. Without evidence that the individual defendants participated in acts causing injury to the plaintiffs, there was no breach of duty to the plaintiffs. See LaClair v. Silberline Mfg. Co., 379 Mass. 21, 29, 31 (1979) (“A corporate officer is liable for torts in which he personally participated whether or not he was acting within the scope of his authority”).
The same difficulty adheres to the judge’s rulings that there was a negligent failure to provide emergency lighting and to provide access to exits from the building, namely, the absence of evidence that the individual defendants participated in the failure to provide the required lighting and ready access to exits.11 The result is that this case is governed by such cases as Burnham v. Beverly Airways, Inc., 311 Mass. 628, 637 (1942), and Buck v. Clauson’s Inn at Coonamessett, Inc., 349 Mass. 612, 614-615 (1965). In Burnham, Justice Qua wrote that there was no evidence that *440the individual defendants “participated in any way” in promoting or permitting the unlawful conduct that the plaintiffs sought to enjoin, and the bill was dismissed as to them. 311 Mass. at 637. Justice Qua added, “The mere fact that [the individual defendants] held, respectively, the offices of president and treasurer of the Beverly Airways, Inc., is not enough to render them liable to this suit.” Ibid. In Buck, Justice Cutter wrote that the individual defendant, president of the defendant corporation, could not be liable to the plaintiff because there was no evidence that he “had been guilty of any negligent misfeasance (as contrasted with nonfeasance) causing injury to the . . . plaintiff.” 349 Mass. at 614-615.
We conclude that Steele, as an officer of the corporation, and Avellar, as the corporation’s managing agent, could not be held liable to the plaintiffs. See Leavitt v. Glick Realty Corp., 362 Mass. 370, 374 (1972) (“an officer of a corporation ... is not liable for nonfeasance to any one but his principal or employer”). See also Osborne v. Morgan, 130 Mass. 102, 103 (1881) (“It is often said in the books, that an agent is responsible to third persons for misfeasance only, and not for nonfeasance”); Restatement (Second) Agency § 352 comment a (1958) (“an agreement to carry out the purpose of the employer, which may be to help others, does not, without more, create a relation between the agent and the others upon which an action of tort can be brought for the harm which results from a failure of the agent to perform his duty to the principal”); Fletcher, Private Corporations § 1137, at 300 (1994) (“An officer of a corporation who takes part in the commission of a tort by the corporation is personally liable for resulting injuries; but an officer who takes no part in the commission of the tort is not personally liable to third persons for the torts of other agents, officers or employees of the corporation”). Nor is there any basis in the evidence to justify “piercing the corporate veil,” as the plaintiffs argue. See My Bread Baking Co. v. Cumberland Farms, Inc., 353 Mass. 614, 619 (1968).
*441The report should have been allowed as to the trust and as to the individuals, and disallowed merely as to the corporation, with the result that we affirm the judgment as to the corporation,12 and reverse the judgment as to the trust and the individual defendants. Judgment shall enter for the trust and the individual defendants.
So ordered.
The various licenses required for the operation of the inn were issued to “Tamerlane Corp. d/b/a The Red Inn.” The plaintiffs’ brief acknowledges that Tamerlane Corp. operated the inn. The lease of the premises, which was in evidence, runs from the trust to Tamerlane Corp.
The amended complaint describes the individual defendants as the “owners and operators” of the Red Inn. This was clearly not so. See note 4, supra. The plaintiffs’ brief describes the individual defendants as being “intimately involved in the operations of the Trust and Tamerlane Corp.” We take this to mean merely that the individual defendants owned the beneficial interests in both the trust and the corporation. Various licenses and license applications describe Avellar as the “Manager” of the inn; Steele signed the lease referred to in note 4, supra, as the President of Tamerlane Corp.
This appeal is properly before us. G. L. c. 231, § 109. The plaintiffs filed their complaint in the District Court seeking the recovery of $250,000. The defendants did not timely remove the case to the Superior Court and thus waived their right to do so. After an unsuccessful appeal to the Appellate Division, this court is the appropriate forum for the defendants’ appeal. Joseph Freedman Co. v. North Penn Transfer, Inc., 388 Mass. 551, 551-552 n.l (1983). See also Greenhouse, Inc. v. Trans World Airlines, Inc., 394 Mass. 60, 62-63 (1985).
Additional facts were found by the Appellate Division. However, the authority of the Appellate Division is “limited to the review of rulings which have been reported and to matters of law arising in connection with the making of reports.” Elliott v. Warwick Stores, Inc., 329 Mass. 406, 409 (1952). The Appellate Division “has no power to make its own findings of fact,” ibid., and we give no weight to conclusions based on its findings.
The defendants’ requests for rulings also challenged the legal sufficiency of the evidence.
The judge made no findings regarding the fire itself (such as the speed with which the fire spread because of the use of an accelerant) other than that it was set by an arsonist.
The judge found that “the landlord . . . exercised some control through its agents.” There were no subsidiary findings to support this conclusipn.
There was no finding that the individual defendants locked the door that prevented the plaintiffs from escaping, or that they even knew that the door was locked. Similarly, there was no finding that the individual defendants knew that the emergency lighting was deficient.
We note that the corporation had no insurance as of 12:01 a.m., October 2, 1989, approximately two and one-half hours before the fire. See Tamerlane Corp. v. Warwick Ins. Co., 412 Mass. 486, 487 (1992).