According to the light novels they are cousins.
Kirigaya Minetaka and Midori, husband and wife’s own child was
Suguha, while Kazuto was Midori’s sister’s, this meant that he was the
child of Suguha’s aunt. Her aunt and her husband, without a choice, left
their only child, who was not even a year old, and passed away in an
accident. The serious nature of the injuries they bared eventually
putting an end to their lives, and Midori was left to take charge of
Kazuto.
That fact was told to Suguha by both her parents during winter
two years ago, around that time, Kazuto was trapped in a virtual reality
game, going by the name of «Sword Art Online». Suguha who had
already received a big shock from the incident, was in a cruel state of
confusion; she went to Midori, asking why she did not tell her earlier
and why she was the only one not being told, and took out her
confusion on Midori.
A bit earlier it is stated that his parents were surprised when Kazuto asked after his real parents so I find it unlikely that they would have lied to him.
“... Even now, I recall that incident like it happened yesterday.
That time when Minetaka-san and I were watching a movie in the
living room, and Kazuto suddenly said from behind, ‘Please tell me
about my real parents’ “.
Suguha motionlessly gazed at Midori’s charming lips with very
light rouge, a light nostalgic bitter smile appearing on them.
“At that time, I was really surprised. Kazuto was only 10 years old.
Till Suguha entered high school... it was a secret that we had planned to
keep for 7 more years, but he found out about his Juki Net’s erase
records.”
Both excerpts are from the prologue of the third light novel Fairy Dance (translations by Baka-Tsuki).
