According to Don LePan's "The Broadview Book of Common Errors in English", the grammar rule here is the difference between the two is
1. Surprised at = the person is disappointed or scandalized whereas
2. Surprised by = shocked at unexpected outcome.