A security guard beats a patron far past what any ejection required, a delivery driver attacks a customer during a dispute, a store employee assaults a shopper — and the injured person, facing real harm, asks the obvious question: can the business that put this person in that role be held responsible? The company’s answer is usually a fast no: that was a personal act, outside the job, nothing to do with us. But employer liability for an assault in Massachusetts is not settled by that denial. Depending on the facts, a business can answer for an employee’s violent act — either because the assault fell within the scope of employment or because the employer was negligent in hiring, retaining, or supervising the person who committed it. Which theory fits depends on the facts, and often both do at once.
These are two separate roads to the same company, and they work differently. One asks whether the assault was connected enough to the job that the employer is vicariously responsible for it. The other asks whether the employer itself was careless — whether it put a known danger in a position to hurt someone. An injured person does not have to choose between them at the outset; both can be pursued, and each reaches situations the other misses. The business’s instinct to call every assault a purely personal act is exactly what these doctrines are built to test. A reflexive denial is a starting position, not a legal conclusion.
What follows is how Massachusetts approaches an employer’s responsibility for an employee’s assault: when an assault falls within the scope of employment, when the employer’s knowledge of a violent history creates its own liability, and how the rules apply to bouncers, security guards, and others authorized to use force. This is general information, not advice about a specific case. Because these claims sit within the broader law of negligence and vicarious responsibility, our overview of a Boston personal injury claim is a useful starting point.
Is a business responsible when its employee attacks someone?
The threshold question is whether an intentional assault — not mere carelessness — can ever be laid at the employer’s door. In Massachusetts, it can, through two distinct theories.
Two routes to the employer
There are two separate ways to hold a business responsible for an employee’s assault, and keeping them distinct matters. The first is vicarious liability: if the assault was within the scope of employment, the employer answers for it under respondeat superior, the same doctrine that makes an employer responsible for a negligent employee’s conduct on the job. The second is direct liability for the employer’s own negligence — negligent hiring, retention, or supervision — where the company itself was careless in putting or keeping a dangerous person in the role. The first looks at the assault’s connection to the job; the second looks at the employer’s own conduct. Keeping the two straight is the key to seeing why a business can be liable even for an act it never sanctioned.
Why the “personal act” defense is not the end
An employer’s reflexive defense is that the assault was a personal act, outside the scope of the job, for which it bears no responsibility. Sometimes that is true — a purely personal dispute an employee happens to pursue at work may fall outside the employer’s liability under the scope-of-employment theory. But even then, the direct-negligence route remains: if the employer knew or should have known the person was dangerous and did nothing, it can be liable for negligent retention or supervision regardless of whether the assault was within the scope of employment. So the “personal act” label, even when it defeats one theory, does not necessarily defeat the claim. The label answers one question, not both. A business hoping to escape on the personal-act theory still has to answer for what it knew.
What this means for an injured person
For someone assaulted by an employee, the practical significance is that the business’s quick denial should not be taken as the final word. Whether the employer is liable depends on the connection between the assault and the job and on what the employer knew about the person it employed — both fact questions, not foregone conclusions. And reaching the employer often matters a great deal, because a business is far more likely than an individual assailant to have the insurance and assets to compensate a serious injury. The two theories together give an injured person more than one path to that responsible party. Where one road is blocked, the other frequently remains open. That redundancy is a feature of these claims, not an accident.
Assault within the scope of employment
The first route asks whether the assault was close enough to the work that the employer is vicariously responsible for it.
When an assault is within the scope
An employer is vicariously liable for an employee’s intentional tort, including an assault, when the conduct was within the scope of employment — that is, when it was in some way connected to and in furtherance of the employer’s business rather than a purely personal pursuit. Massachusetts looks at whether the conduct was the kind the employee was hired to perform, occurred within the authorized time and space of the job, and was motivated at least in part by a purpose to serve the employer. An assault that grows out of a work task — a confrontation the job itself created — can fall within the scope even though the employer never authorized violence. What matters is the link to the work, not any permission the employer would obviously never give. The connection to the work, not the employer’s approval, is what counts. No employer authorizes an assault, yet employers are routinely held responsible for ones that arise from the job. The absence of authorization is not the shield employers assume it to be.
The job that creates the confrontation
Some jobs carry a built-in potential for physical confrontation, and that changes the analysis. Where an employee’s duties involve dealing with disputes, ejecting people, enforcing rules, or handling conflict, an assault that arises from performing those duties is more readily seen as within the scope of employment. The confrontation is not a random personal matter; it flows directly from the work the employer assigned. A dispute that erupts out of the very task the employee was carrying out for the business is the paradigm of scope-of-employment liability, because the job itself put the employee in the situation that led to the violence. The employer set the stage even if it never wrote the script. Courts have long recognized that some roles carry a foreseeable risk of exactly this kind of overreaction.
The purely personal act
On the other side of the line is the assault driven entirely by personal reasons that merely happened at work. Where an employee attacks someone over a private grievance unconnected to the job — settling a personal score that has nothing to do with the employer’s business — the conduct is more likely to fall outside the scope of employment, and vicarious liability may not attach. The distinction turns on motivation and connection to the work: an act done to serve the employer’s interests, however wrongly, differs from one done purely for the employee’s own personal reasons. The same punch can be inside or outside the scope depending on why it was thrown. But even a purely personal assault can still expose the employer through the separate negligence theory, so this line is not the whole story. The scope question decides vicarious liability, not the case as a whole. A win for the employer on scope is only a partial win at best.
The employer’s knowledge of a violent history
The second route does not depend on the scope of employment at all. It asks whether the employer’s own carelessness put a known danger in a position to hurt someone.
Negligent hiring, retention, and supervision
An employer has its own duty to exercise reasonable care in hiring, retaining, and supervising employees, particularly where the job puts them in contact with the public. When an employer hires or keeps on a person it knew or should have known was dangerous — someone with a history of violence relevant to the role — and that person then assaults someone, the employer can be directly liable for its own negligence. This is not about whether the assault served the employer’s business; it is about the employer’s failure to act reasonably in the face of a known risk. The claim targets the company’s own carelessness, not merely the employee’s act. It asks what the employer did wrong, not just what the employee did. That reframing is what makes the company a defendant in its own right rather than a bystander.
What the employer knew or should have known
The heart of a negligent-retention claim is the employer’s knowledge. Did the company know, or should reasonable care have revealed, that the employee posed a risk of the kind of harm that occurred? A documented history of violence, prior complaints, warning signs during employment, or a background that a reasonable check would have uncovered can all establish that the employer was on notice. Where the employer had that notice and kept the person in a role that gave them the opportunity to cause harm, its failure to act — to investigate, reassign, supervise, or terminate — becomes the negligence that supports the claim. The employer’s inaction in the face of a known risk is the wrong the claim targets. Foreseeability of the harm, given what the employer knew, is the central question. The more the danger was knowable in advance, the stronger the claim becomes. Hindsight is not required; reasonable foresight is.
Why this reaches beyond the scope theory
The great advantage of the negligence theory is that it does not care whether the assault was within the scope of employment. Even a purely personal attack — one that would defeat vicarious liability — can support a claim if the employer negligently placed or kept a known dangerous person in the position to commit it. This is why the two theories work together: where the scope-of-employment route fails because the assault looks personal, the negligent-retention route may still reach the employer through its own independent fault. An injured person is well served by developing both, because they cover different gaps. Relying on a single theory leaves the claim vulnerable to a single defense.
Bouncers, security guards, and authorized force
A special and common category involves employees whose jobs authorize the use of some force — and what happens when that force goes too far.
Force that is part of the job
Bouncers, security guards, and similar personnel are hired, in part, to control conduct and, where necessary, use reasonable force — to eject an unruly patron, restrain someone, or maintain order. Because using force is within the very role the employer created, an assault by one of these employees is often squarely within the scope of employment. When a bouncer’s job is to remove people and a removal turns violent, the violence flows directly from the assigned task, which makes vicarious liability far more readily available than it would be for an employee with no such role. The employer put the person in a position where force was expected. Having built a role around the use of force, the business cannot be surprised when force is used. The predictable risks of a job belong, in part, to the employer that created it. That is why security roles so often produce liability for the venues that rely on them.
When authorized force becomes excessive
The line is crossed when the force exceeds what the situation reasonably required. An ejection that becomes a beating, a restraint that turns into gratuitous violence, or force used long after any threat has passed goes beyond the reasonable force the job authorized. That excess is where liability lives: the employee was doing the job — using force — but did it wrongfully and to an unreasonable degree. Because the excessive force still arose from the authorized task, the employer frequently remains vicariously responsible — the wrongful degree of force does not sever the connection to the job that authorized force in the first place — and the employer’s own training, supervision, and hiring of security personnel can add a negligence theory on top. Security work is a setting where both routes to the employer often apply at once. That overlap is part of why these cases can be among the strongest against an employer.
The employer’s responsibility for security personnel
Businesses that employ or contract for security bear real responsibility for how that force is used. Beyond vicarious liability for a guard’s excessive force within the scope of the job, an establishment can be negligent in whom it hires for these sensitive roles, how it trains them, and how it supervises their use of force. This is distinct from a property owner’s separate duty to protect patrons from the criminal acts of third parties, a subject addressed in our discussion of negligent security. Here the wrongdoer is the establishment’s own employee, which is what brings employer liability — both vicarious and direct — to the center of the case. The focus shifts from a stranger’s crime to the establishment’s own worker and its own choices. Those choices — whom to hire, how to train, whether to supervise — are squarely the employer’s own.
Injuries, parties, and recovery
Assault cases involve serious harm and a set of responsible parties that reaches beyond the individual attacker.
The injuries these cases involve
An assault can cause devastating harm — broken bones, head trauma, a serious brain injury, and lasting psychological effects that outlast the physical ones. The trauma of a violent attack can shape a person’s life long after the bruises heal. Some of these are catastrophic injuries with permanent consequences. The severity of these injuries is often what makes reaching the employer essential, because an individual assailant — frequently a low-wage employee — rarely has the resources to compensate a serious injury, while the business that employed them may have the insurance and assets to do so. The gap between an individual’s resources and a company’s is often the whole practical difference in these cases. A serious brain injury does not become cheaper because the person who caused it has nothing.
Who is responsible
Responsibility can rest with several parties. The employee who committed the assault is personally liable for the intentional act. The employer may be vicariously liable if the assault was within the scope of employment, and directly liable if it was negligent in hiring, retaining, supervising, or training the person. Where security is provided by a separate company, that contractor and the establishment may both bear responsibility. The use of an outside security firm rarely lets the establishment wash its hands of what happens on its premises. Identifying every responsible party — and pinning down the employer’s liability under both theories — is central to building a claim that reaches a party able to compensate the harm. The individual attacker is rarely the party that makes an injured person whole. The search for a solvent, responsible defendant is central to these cases, not incidental to them.
What a claim can recover
An assault victim can generally recover the full measure of the harm: medical expenses, lost income and earning capacity, and compensation for pain, suffering, and the lasting effects of the injury, including its psychological toll. Where a comparative-fault issue is raised, Massachusetts General Laws chapter 231, section 85 reduces rather than automatically bars recovery, though the deliberate nature of an assault often makes fault-shifting to the victim difficult. It is hard to blame a person for being the target of someone else’s intentional violence. Comparative-fault arguments tend to land poorly when the defendant chose to strike. Reaching a solvent employer through vicarious or direct liability is frequently what makes a real recovery possible rather than a judgment against an individual who cannot pay. A judgment nobody can satisfy does little for a badly injured person.
Protecting your claim
Employer-liability assault cases are built on the connection between the assault and the job and on what the employer knew.
Proving scope and notice
The central task is developing both theories: the facts connecting the assault to the employee’s job for the scope-of-employment route, and the evidence of what the employer knew or should have known about the person for the negligence route. That means establishing what the employee was hired to do, how the confrontation arose from the work, and, separately, the employee’s history and any warning signs the employer had or should have discovered. The two evidentiary tracks are gathered together but proven separately. A single investigation can build both, but each has its own elements to satisfy. Building both in parallel is what keeps the claim alive if the employer defeats one theory by characterizing the assault as personal. Two independent routes are harder to close off than one. The defense has to defeat both to walk away, and that is a taller order.
The evidence that matters
The proof lives in the employer’s records and the circumstances of the incident: personnel and hiring files, any background checks, prior complaints or disciplinary records, training and supervision practices, and the accounts of what happened and why. In a security setting, the establishment’s policies on the use of force and its supervision of guards are central. How a venue trains and monitors the people it empowers to use force often tells the whole story. Much of this material is in the employer’s hands, so obtaining it through the litigation process — and reading it against the assault — is frequently what exposes both the job connection and the employer’s notice of the danger. Employers rarely volunteer the records that establish their own fault, so obtaining them is much of the work.
When to call a Boston injury lawyer
When an employee’s assault causes serious injury and the business waves it away as a personal act, that denial should be tested against both the scope-of-employment and negligent-retention theories, not accepted. A lawyer can develop the connection to the job, uncover what the employer knew, and pursue the business along with every other responsible party; the work is handled on contingency, so there is no fee unless there is a recovery. Early investigation matters here, because the employer’s records and witness memories are the heart of the case. Our Boston personal injury attorneys handle serious assault and premises-related injury claims, across the Commonwealth and in nearby communities including Quincy and Cambridge, as reflected across our practice areas. If you were assaulted by an employee and the business is denying responsibility, a first conversation costs nothing, and you can reach out to have the employer’s role examined.
Reviewed and Approved By
This article was reviewed for legal accuracy by Daniel J. Larson, the founding attorney of Larson Law and a Massachusetts-barred personal injury lawyer in Boston. He represents individuals and families harmed by negligence and misconduct in serious-injury matters arising from assaults, unsafe premises, motor-vehicle collisions, and other preventable incidents. Attorney Larson works litigation-first, developing each case through careful investigation, discovery, and expert analysis with the expectation that it may be tried. Before founding the firm, he defended doctors, hospitals, and other healthcare providers in malpractice litigation at a Boston firm — experience that informs how he anticipates the way businesses and their insurers defend these claims. He is a member of the Massachusetts Bar Association and the Massachusetts Academy of Trial Attorneys.
Frequently asked questions
Can I sue a business if one of its employees assaulted me?
Possibly, through either of two theories. If the assault was within the scope of employment — connected to and arising from the employee’s job — the business can be vicariously liable under respondeat superior. Separately, if the employer knew or should have known the person was dangerous and negligently hired, kept, or supervised them, it can be directly liable for its own negligence, even if the assault was personal. The business will often call the attack a purely personal act, but that label, even when it defeats one theory, does not necessarily defeat the claim.
What does “scope of employment” mean for an assault?
It asks whether the assault was connected to and in furtherance of the employer’s business rather than a purely personal act. Courts look at whether the conduct was the kind the employee was hired to perform, happened within the time and space of the job, and was motivated at least partly to serve the employer. An assault that grows out of a work task — a confrontation the job itself created — can be within the scope even though the employer never authorized violence. A private grievance settled at work is more likely outside it.
The employer says the attack was personal. Do I still have a claim?
Maybe. Even if the assault was personal enough to fall outside the scope of employment, the employer can still be liable under a negligence theory. If the company knew or should have known the employee had a history of violence relevant to the role and kept them in a position to cause harm, its own carelessness in hiring, retaining, or supervising can support the claim. That negligent-retention route does not depend on the assault serving the employer’s business, which is exactly why it reaches cases the scope theory misses.
What about a bouncer or security guard who used too much force?
Those cases are often strong. Because using reasonable force is part of the job for bouncers and security guards, an assault by one of them frequently falls within the scope of employment, making the employer vicariously responsible. When the force exceeds what the situation reasonably required — an ejection that becomes a beating, or force used after any threat has passed — that excess is where liability lives, and the employer often remains responsible because the excessive force still arose from the authorized task. The establishment’s hiring, training, and supervision of security can add a negligence claim as well.
Why go after the employer instead of just the person who hit me?
Usually because of the ability to actually compensate the injury. An individual assailant, often a low-wage employee, rarely has the resources to pay for a serious injury, while the business that employed them may have the insurance and assets to do so. Reaching the employer through vicarious or direct liability can be the difference between a real recovery and a judgment against someone who cannot pay. That is why it is worth testing the business’s denial rather than accepting that the assault was purely personal.
Results Disclaimer: Past case results, settlements, and verdicts mentioned on this website do not guarantee or predict a similar outcome in any future case. Every case is unique and depends on its own facts and legal issues.