We developed an attribute-shuffling obfuscation for database applications in cloud environment and studied its potential in preventing information leaks to malicious administrators at cloud providers, who have unlimited and non-censored accesses to any local resources, possibly including the system security logs. The proposed obfuscation allows database management systems at cloud servers to perform fundamental query operations while cloud users' information is protected against leaks to malicious administrators. We studied the performance of the proposed obfuscation to find that the inflation of obfuscated tables at cloud servers and the increase in the network traffic load will be the major overhead. We developed algorithms that mitigate the inflation of obfuscated tables using 'α' parameter and the increase in the network traffic load using the query constructor. The former achieved a linear relation between the obfuscated table size and the degree of obfuscation how hard for malicious administrators to understand the meaning of users' information. The latter achieved that the network traffic load nearly converged to that of no obfuscation for busy systems. We conclude that the proposed attribute-shuffling obfuscation will be feasible and efficient for busy and large database systems, while it adapts to database systems with diverse configurations. Copyright © 2015 John Wiley & Sons, Ltd.