In some aspects, a computing system can obfuscate sensitive data based on data aggregation. A sensitive database containing sensitive data records can be joined with a grouping database containing a group identifier. The joining can be performed through a linking key that links a sensitive data record with a grouping data record in the grouping database. A grouping identifier can thus be obtained for each of the sensitive data record. The sensitive data records can be aggregated into aggregation groups based on their respective values of the group identifier. Statistics are calculated for the sensitive attributes of the sensitive data records in each aggregation group and are included in the aggregated data as the obfuscated version of the sensitive data. The aggregated data can be utilized to serve data queries from entities authorized or unauthorized to access the sensitive data.