claims should her Title IX claim fail. See Nightingale Home Healthcare, Inc. v. Anodyne Therapy, LLC, 589 F.3d 881, 883 (7th Cir.2009) (resolving supplemental claims on appeal where no party argued for relinquishment); CropLife, 432 F.3d at 734 (same). Accordingly, we will take up the merits of Doe-2’s Illinois tort claims.
Under Illinois law, a plaintiff pleading willful and wanton misconduct must establish the same basic elements of a negligence claim, which are the existence of a duty, breach of that duty, and an injury proximately resulting from the breach. Krywin v. Chi. Transit Auth., 391 Ill.App.3d 663, 330 Ill.Dec. 865, 909 N.E.2d 887, 890 (2009). A willful and wanton claim has the additional requirement that the breach be not merely negligent, but with “conscious disregard for the welfare of the plaintiff.” Ortega-Piron ex rel. Doe v. Chi. Bd. of Educ., 213 Ill.2d 19, 289 Ill.Dec. 642, 820 N.E.2d 418, 423 (2004).
In trying to identify a duty that the defendants owed to her, Doe-2 runs into the familiar rule that a person ordinarily “has no duty to act affirmatively to protect another from criminal attack by a third person.” Iseberg v. Gross, 227 Ill.2d 78, 316 Ill.Dec. 211, 879 N.E.2d 278, 284 (2007) (citing Restatement (Second) of Torts § 314 (1965)). The direct source of Doe-2’s injury was a criminal sexual assault by Jon White, a third party whom these McLean County defendants didn’t control at the time of the assault. So even if the defendants knew that White was a sexual harasser who likely would assault Doe-2 or other Urbana students, these facts alone would not create a duty under Illinois common law to protect Doe-2.
That is so even though Illinois statutory law would require the defendants to act. Under the Illinois Abused and Neglected Child Reporting Abuse Act, “school personnel” who have “reasonable cause to believe” that a student has suffered abuse must notify the Illinois Department of Children and Family Services. 325 ILCS 5/4. But ANCRA’s mandate to report child abuse does not create any duty to the abused child enforceable under Illinois tort law. In Cuyler v. United States, 362 F.3d 949, 952-53 (7th Cir.2004), we explained that an ANCRA violation does not give rise to a private tort action unless the violation also breaches a common law duty of care owed to the plaintiff. The Illinois Appellate Court similarly concluded in Tanya S. ex rel. Doe 1 v. N. Cent. Behavioral Health Sys., Inc., 352 Ill.App.3d 284, 287 Ill.Dec. 493, 816 N.E.2d 4, 7-8 (2004), that ANCRA did not provide a private cause of action for a psychology clinic’s failure to report sexual abuse by one of its patients. The court found “no evidence that the statute was designed to ... impose civil liability on those who fail to report.” Id. at 8. From this authority it follows that Doe-2 cannot rely on the defendants’ alleged violation of ANCRA’s reporting requirements to support her private tort claims; she must identify a common law duty owed to her by the defendants.
One common law duty to protect against third-party attacks arises where the defendant has a “special relationship” with the plaintiff. Iseberg, 316 Ill.Dec. 211, 879 N.E.2d at 284. Illinois courts have recognized that some relationships between public school districts and their students create a duty to protect, but only under certain circumstances. A school district does not have a duty to protect its student body at large against the general risk of criminal attack, even if the attacker is another student subject to the district’s authority. See Lawson v. City of Chi, 278 Ill.App.3d 628, 215 Ill. Dec. 237, 662 N.E.2d 1377, 1389 (1996) (dismissing a negligence claim arising out